Skip to content

Security: hackjunction/junction-volunteers-hackathon

Security

SECURITY.md

Security and data boundaries

This repository is a development sandbox. It contains no production data or credentials. Use only fictional applicant records and your own test services.

The hackathon does not authorize testing Junction's live website, database, authentication accounts or infrastructure. Reproduce issues locally. Keep authentication, workspace isolation and authorization checks intact.

Never post credentials, personal data or a working production exploit in a public issue. Report sensitive findings privately to the challenge organizers using the event's designated contact channel. Public issues are suitable for ordinary bugs demonstrated with fictional data.

The .env.example values are placeholders or local-only demo database credentials. .env*, database dumps and applicant export files are ignored by Git. Review staged files before pushing.

There aren't any published security advisories