MotionLy is a research-focused, open-source project. We take security and privacy seriously, especially given the potential use of this software in clinical and research settings with vulnerable populations.

This document describes how to report security issues and what you can expect from the maintainers.

MotionLy does not currently maintain a formal long-term support (LTS) policy.
Security fixes will typically be applied to the latest main branch and the most recent release(s), where applicable.

If you are running a fork or a pinned commit:

• Please regularly pull from main to keep your deployment up to date.
• Consider backporting security patches to your own fork if you cannot upgrade immediately.

If you discover a security vulnerability, please DO NOT open a public GitHub issue.

Instead, report it privately via:

• Email: security@motionly.app (or your designated security contact)

When reporting, please include:

• A clear description of the issue and its potential impact.
• Steps to reproduce (if possible).
• Any relevant logs, screenshots, or proof-of-concept code.
• Your assessment of severity (if you have one).

We aim to:

• Acknowledge receipt of your report within 5 business days.
• Provide an initial assessment and next steps within 10 business days.

MotionLy, as provided in this repository, does not ship with a production-ready data storage layer for patient or participant data.

If you extend this codebase for clinical or research use:

• You are responsible for implementing secure authentication, authorization, and storage.
• You must ensure compliance with applicable regulations (e.g., HIPAA, GDPR, local privacy and health data laws).
• Avoid storing any personally identifiable information (PII) or protected health information (PHI) unless your environment meets regulatory and institutional requirements.

Never include real patient data in:

• Git commits or pull requests.
• GitHub issues, discussions, or comments.
• Example datasets checked into this repository.

After a vulnerability has been resolved:

• We may publish a short advisory summarizing:
  • The nature of the vulnerability.
  • Affected versions (if applicable).
  • Mitigation or upgrade instructions.
• We will credit reporters who wish to be acknowledged, subject to mutual agreement.

We strongly discourage zero-day style public disclosure without prior coordination, especially for deployments involving real patients or sensitive health data.

If you are deploying MotionLy or a derivative:

• Rotate secrets regularly (API keys, database passwords, etc.).
• Use environment variables or a secrets manager—never hardcode secrets in the repository.
• Run your deployment behind:
  • HTTPS with modern TLS configuration.
  • Proper authentication and access control.
• Monitor logs for unusual activity and keep all dependencies up to date.

For additional security hardening, consult:

• The official Next.js security documentation.
• Best practices for your chosen cloud provider and database services.

Thank you for helping keep MotionLy and its users safe.