Please report security problems privately, not as public issues.

The best way is GitHub's private reporting: open the Security tab and choose Report a vulnerability, or go straight to a new report. Only the maintainers and you can see it.

If you can't use GitHub, email ancsemi@haven-app.com instead.

It helps to include:

• what an attacker can do, and what they need first (an account, a role, admin access)
• the steps to reproduce it, and the Haven version you tested
• the files involved and a suggested fix, if you have one

• A reply within a few days saying the report was received.
• Fixes ship in a normal Haven release. You're welcome to retest before it goes out.
• Once the fix is released, the advisory is published with credit to you, unless you'd rather stay anonymous.

Please keep the details private until the fix is released.

Only the latest release gets security fixes. Haven updates in place, so the fix for any problem is to update to the newest version.