Skip to content

Security: anolilab/lunora

Security

Report a vulnerability

SECURITY.md

Security Policy

Thanks for helping keep Lunora and its users safe.

Reporting a vulnerability

Email security@anolilab.de with as much detail as you can share. PGP / encrypted mail is welcome — request a key in your first message if you'd like to use one.

Alternatively, file a GitHub Security Advisory directly. Do not open a public issue or discussion for security problems.

Useful things to include:

  • A clear description of the vulnerability and the affected package(s) (@lunora/runtime, @lunora/auth, etc.).
  • Reproduction steps — a minimal repro repo, proof-of-concept script, or curl invocation is ideal.
  • Impact assessment as you see it (data exposure, RCE, auth bypass, DoS, …).
  • The commit SHA or package version you tested against.
  • Your name or handle if you'd like public credit once the issue is fixed.

What to expect from us

  • Acknowledgement within 72 hours of receipt.
  • A coordinated disclosure timeline negotiated with you. Default target: a fix shipped within 30 days of confirmation for high-severity issues; longer is fine if the bug is low-severity or hard to reproduce.
  • Credit in the release notes and (eventually) a security hall of fame, unless you prefer to stay anonymous.
  • No legal action against good-faith research that follows this policy.

Supported versions

Lunora is v0.1-alpha. Only the current alpha branch and the latest published alpha tag of each package are supported. Once we ship a stable release line, this table will reflect actual version support.

Version Supported
alpha (latest) ✅
anything older ❌

Scope

In scope:

  • Code in this repository, including all packages under packages/ and apps under apps/.
  • The default behaviour of @lunora/cli (init, dev, deploy, run, reset, codegen).
  • Public APIs surfaced by @lunora/server, @lunora/runtime, @lunora/client, @lunora/react, and the rest of the published packages.

Out of scope (report to Cloudflare directly):

  • Vulnerabilities in Cloudflare Workers, Durable Objects, D1, R2, Queues, or any other Cloudflare product itself.
  • Vulnerabilities in upstream dependencies — please report to the dependency's maintainers; if it materially affects Lunora we'll handle the coordinated upgrade.

Hall of fame

TBD — once we have our first credited report it goes here. Be the first.

There aren't any published security advisories