Security fixes are applied to the latest commit on main.

Do not open a public issue containing personal data, credentials, a working exploit, or a production CloudBase identifier. Use GitHub's private vulnerability reporting feature if it is enabled for this repository. Otherwise, contact the repository owner privately through their GitHub profile and include only the minimum reproduction details needed.

• Authentication is based on cloud.getWXContext().OPENID inside cloud functions.
• The client may request an operation, but it is not trusted to identify the acting user or set protected ownership/status fields.
• Ride and request mutations verify ownership or participation server-side.
• Marketplace create/update/delete functions validate ownership and accepted fields.
• Contact details are returned only for the relevant ride, request, or online marketplace scope.
• List and history responses remove participant identifiers and unnecessary profile data.
• Core ride collections are intended to be inaccessible from the client SDK.

The example rules are a secure baseline, not a substitute for reviewing the rules actually deployed in CloudBase. Cloud functions use server credentials and bypass client database/storage rules, so each function must enforce its own authorization.

Production operators must also provide:

• marketplace image moderation or manual review;
• abuse throttling and monitoring;
• a privacy notice, consent flows, retention limits, and deletion handling;
• secret scanning and separate development/production environments;
• authorization tests using multiple real test identities.

Never commit config.js, project.private.config.json, AppIDs, environment IDs, access tokens, exported user data, or database backups.