Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via email to: security@example.com (replace with your email)

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the following information in your report:

• Type of issue (e.g., XSS, CSRF, SQL injection, authentication bypass, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

This project follows these security best practices:

• Content Security Policy (CSP) - Configured in nginx.conf
• Type-safe environment variables - Zod validation in src/config/env.ts
• Secure HTTP client - Axios with interceptors, automatic token refresh
• Input validation - Zod schemas for all forms and API responses
• Error tracking - Sentry integration for production error monitoring
• Dependency auditing - Automated via Renovate/Dependabot
• HTTPS enforcement - Production deployments use HTTPS only
• XSS protection - React's built-in escaping, no dangerouslySetInnerHTML
• Authentication - Token-based auth with secure storage

# Example from nginx.conf
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin

Never commit sensitive data:

# ❌ DO NOT commit .env files with secrets
.env.local
.env.production

# ✅ Use .env.example as template
VITE_API_URL=https://api.example.com
VITE_SENTRY_DSN=your-sentry-dsn

When we receive a security bug report, we will:

1. Confirm receipt within 48 hours
2. Assess severity and determine priority
3. Develop and test a fix
4. Release a security patch (within 7 days for critical issues)
5. Publish a security advisory on GitHub
6. Credit the reporter in release notes (unless you prefer anonymity)

Subscribe to security advisories:

1. Watch this repository on GitHub
2. Enable "Security alerts" in your notification settings
3. Check the Security Advisories page

No known security vulnerabilities at this time.

We recommend using these tools:

• npm audit / pnpm audit - Check for vulnerable dependencies
• Snyk - Continuous security monitoring
• OWASP ZAP - Web application security scanner
• Lighthouse - Security audits in Chrome DevTools

For security concerns: security@example.com (replace with your email)

For general questions: Open a Discussion

Thank you for helping keep this project secure! 🔒