Security fixes are applied to the default branch (main).

Please do not open public GitHub issues for security vulnerabilities.

Report security issues privately by opening a GitHub Security Advisory or contacting the repository maintainers directly.

Include:

• Description of the issue and potential impact
• Steps to reproduce
• Affected versions or commits
• Suggested fix (if any)

We aim to acknowledge reports within a few business days and will coordinate disclosure before any public fix.

• Change all demo passwords before production use
• Set a strong, unique AUTH_SECRET
• Use TLS in production and restrict database network access
• Review PostgreSQL RLS policies in prisma/rls.sql for your deployment model