We actively support the latest stable version of TSA InternHub. Security issues should be reported privately via email to security@tsa-internhub.example.
Please do NOT disclose security vulnerabilities publicly. Instead, email security@tsa-internhub.example with details of the issue. We appreciate your responsible disclosure.
The project maintainers will:
- Acknowledge receipt of the report within 48 hours
- Evaluate the severity and impact of the issue
- Provide a timely fix or mitigation
- Credit the reporter in the release notes (unless they request to remain anonymous)
- All server actions validate permissions via
hasPermission(role, "MANAGE_*") - Input validation using Zod schemas
- Rate limiting on all API endpoints
- Environment variables for secrets (BETTER_AUTH_URL, CLIENT_URL, QSTASH_URL, QSTASH_TOKEN)
- TypeScript type safety throughout
- Dependencies kept up to date via
yarn audit
Report security issues in English, including:
- Component/feature name
- Steps to reproduce
- Expected vs. actual behavior
- Any stack traces or error messages
- Browser/OS environment
This policy covers the TSA InternHub web application, its APIs, and associated infrastructure. It does not cover third-party services integrated into the platform (e.g., Cloudinary, Upstash, Better Auth) beyond the project's control.
For security issues: security@tsa-internhub.example