Security

Report a vulnerability

SECURITY.md

Security Policy

Public guides:

Please avoid posting full exploit details in a public issue.

Preferred reporting path

Use a private GitHub Security Advisory if available.
If private reporting is not available, open a minimal public issue and request a private channel.

Examples of security-sensitive areas

request filtering and access checks
settings storage and secret handling
upload and file-processing paths
code that validates untrusted input

General guidance

do not commit secrets, tokens, or private local data
do not attach raw .env, full runtime/ snapshots, or personal media/project files to public reports
keep reproduction steps as small as possible in public reports
when in doubt, prefer private reporting first

There aren’t any published security advisories