We take security seriously. If you discover a vulnerability, please report it responsibly.

1. Do NOT open a public issue for security vulnerabilities.
2. Email your report to the repository maintainer via GitHub private messaging or by opening a private security advisory.
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours of your report
• Assessment: We'll evaluate severity and impact within 7 days
• Fix: Critical vulnerabilities will be patched as quickly as possible
• Disclosure: We'll coordinate disclosure timing with you

The following are in scope:

• SQL injection, XSS, CSRF
• Authentication / authorization bypass
• Data exposure or leakage
• Server-side request forgery (SSRF)
• Remote code execution

• Denial of service (DoS) attacks
• Social engineering
• Issues in third-party dependencies (report these upstream)
• Issues requiring physical access to the server

When deploying PickOne to production, ensure you:

• Change APP_SECRET to a cryptographically random value
• Set APP_ENV=production
• Configure CORS_ORIGINS to only allow your domain
• Use HTTPS with valid TLS certificates
• Set strong PostgreSQL credentials
• Keep all dependencies up to date
• Enable Nginx security headers (included by default)

Thank you for helping keep PickOne secure. 🔒