Security fixes are applied to the latest minor release line. Older minor versions may receive fixes for critical issues at the maintainers' discretion — when in doubt, please upgrade.

Please do not open a public GitHub issue for security reports.

Use GitHub Security Advisories to report privately. This lets us discuss, fix, and coordinate disclosure before details become public.

When reporting, please include:

• A description of the issue and its potential impact.
• Steps to reproduce, or a minimal proof-of-concept.
• Affected package version(s), Laravel version, and PHP version.
• Any suggested fix or mitigation (optional).

• Acknowledgement: within 5 business days.
• Initial assessment: within 10 business days.
• Fix timeline: depends on severity. Critical issues get prioritized; lower-severity issues may be batched into the next regular release.

We'll keep you updated on progress and credit you in the advisory unless you'd prefer to stay anonymous.

Things in scope for this project:

• Vulnerabilities in any code published under OffloadProject\NotificationPreferences\ (manager, channel filter, traits, model, facade, events, exceptions, controller, console command).
• Unsubscribe link issues — predictable, leakable, or replayable signed URLs that could allow unauthorized preference changes; URLs that act on a different user than the signer; missing or bypassable signature validation; CSRF/clickjacking gaps on the unsubscribe POST endpoint.
• Authorization bypass via the AuthorizesNotification interface or the ability config key (e.g., a user receiving notifications they should not be authorized for, or seeing them in the preferences UI).
• Forced-channel bypass that lets a user disable a notification the package declares as forced.
• Information disclosure via events, exceptions, or the preferences table output (e.g., leaking other users' preferences or notification metadata they shouldn't see).
• SQL injection, mass-assignment, or query-scope bypass in package-provided Eloquent code.
• Insecure defaults in the published config or migrations.

Things not in scope (please report upstream or with the relevant project):

• Vulnerabilities in Laravel itself or other Composer dependencies — please file with the respective project.
• Application-level misconfiguration in a consuming app (e.g., disabling the signed middleware on the unsubscribe route, exposing the routes without rate limiting, registering a notification under the wrong ability, or logging user preferences in app code).
• Issues caused by user-supplied implementations of the package's extension points (custom channels, custom notifications, overridden trait methods, custom Gate closures).
• Vulnerabilities in the host application's authentication, mail driver, queue driver, or database.

Once a fix is published, we will:

1. Publish a GitHub Security Advisory with details and credit.
2. Tag a patch release.
3. Update the changelog with a brief mention (without exploit details prior to the disclosure window).

Thanks for helping keep the project and its users safe.