Only the main branch and the version currently deployed from it receive security fixes. Older commits, forks, and unmerged branches are not supported.

Please report vulnerabilities privately using GitHub Private Vulnerability Reporting: open the Security tab of this repository and choose Report a vulnerability.

Do not open public issues, pull requests, or discussions for security problems.

Please include a description, affected component, reproduction steps or proof of concept, and the potential impact.

• Acknowledgement within 3 business days.
• Triage and severity assessment within 7 business days.
• We will keep you updated on the fix progress and coordinate the release.

• The Next.js BFF API routes, session/cookie handling, route protection, client-side code, the container image, and the CI workflows in this repository.
• XSS, CSRF, SSRF, auth bypass, and secret leakage through the BFF or the browser bundle.

Out of scope: social engineering, denial-of-service via volumetric traffic, and findings in third-party services we do not operate.

We follow coordinated disclosure: please give us a reasonable time to ship a fix before any public disclosure. We will credit reporters in the advisory unless they prefer to remain anonymous.