Thank you for helping keep Estatio secure.

Please do not report security vulnerabilities through public GitHub Issues.

At this time, only the latest release is actively supported with security updates.

If you discover a security vulnerability, please report it privately.

Include:

• Description of the vulnerability
• Steps to reproduce
• Impact
• Proof of concept (if available)
• Suggested mitigation (optional)

Please allow reasonable time for investigation before publicly disclosing the issue.

After receiving a report, maintainers will:

1. Confirm receipt.
2. Investigate the issue.
3. Determine severity.
4. Develop a fix.
5. Publish a security update.
6. Credit the reporter (if desired).

We kindly ask security researchers to:

• Avoid publicly disclosing vulnerabilities before a fix is available.
• Avoid accessing or modifying other users' data.
• Avoid denial-of-service testing.
• Act in good faith.

If you deploy Estatio in production:

• Keep PHP updated.
• Keep Laravel updated.
• Use HTTPS.
• Rotate application secrets.
• Never commit .env.
• Keep Composer dependencies updated.
• Enable database backups.
• Use secure passwords.
• Restrict production access.
• Review third-party packages regularly.

Thank You

We appreciate the efforts of everyone who helps improve the security of Estatio.