Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability, please report it via a private channel.

Best Practices

Do not commit secrets or credentials
Use environment variables for configuration
Validate all inputs
Use HTTPS in production

Authentication

JWT-based authentication
Role-based authorization

Dependencies

Keep dependencies up to date
Use automated vulnerability scanning where possible

There aren't any published security advisories