We take security seriously at CalendarMap. If you discover a security vulnerability, please report it responsibly.

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Use GitHub Security Advisories to report privately

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial response: Within 48 hours
• Status update: Within 7 days
• Fix timeline: Depends on severity (critical: ASAP, high: 7 days, medium: 30 days)

CalendarMap processes CSV files entirely in the browser. Your event data never leaves your device.

• CSV parsing: Client-side (PapaParse)
• ICS generation: Client-side
• File downloads: Generated locally via Blob URLs

• API keys or secrets
• .env files (use .env.example with placeholders)
• Customer data or PII
• Private keys or certificates

• No hardcoded secrets
• Input validation on all user data
• No sensitive data in logs
• Proper error handling (no stack traces to users)
• Dependencies are up to date

We use Dependabot to keep dependencies updated. Security updates are prioritized and merged promptly.

We appreciate security researchers who help keep CalendarMap safe. Responsible disclosures will be acknowledged (with permission) in release notes.