Security

SECURITY.md

Security Policy

Supported Version

The main branch is the active development version.

Reporting A Vulnerability

Please do not open a public issue for secrets, authentication bypasses, SQL injection, stored XSS, or data exposure reports.

Report security concerns privately to the repository owner through GitHub profile contact details. Include:

A clear description of the issue
Steps to reproduce
Affected endpoint, controller, or file
Suggested fix, if known

Security Expectations

Keep .env private
Rotate exposed API keys immediately
Use HTTPS in production
Disable APP_DEBUG in production
Keep Composer dependencies updated
Do not publish live database dumps or session files

There aren't any published security advisories