Security

SECURITY.md

Security Policy

Reporting a vulnerability

Please do not open public issues for security vulnerabilities.

Report vulnerabilities privately to maintainers with:

affected endpoint/file
impact description
reproduction steps
suggested remediation (if available)

Secret handling expectations

Never commit .env files or service-account JSON credentials.
Rotate credentials immediately if exposure is suspected.
Use immutable Cognito sub IDs for authorization decisions.
Restrict CORS origins and keep API keys out of client bundles.

There aren't any published security advisories