Releases use calendar versioning (YY.MM.DD, e.g. 26.07.18). Tags are v* (e.g. v26.07.18).

Please do not open a public issue for security-sensitive reports.

1. Use GitHub Security Advisories if available, or
2. Email the maintainer via the GitHub profile contact on 1tsRajOwO

Include steps to reproduce, impact, and (if possible) a suggested fix. We aim to acknowledge within 7 days.

• Keep AUTH_SECRET, Google/Discord OAuth secrets, and SUPABASE_SERVICE_ROLE_KEY out of client bundles and commits
• Never commit .env.production, .env.local, or packed Electron env files
• Desktop packaging (electron/prepare-standalone.js / CI) may embed server env into the standalone tree so the local Next process can run. Treat every desktop build as containing production-grade secrets (OAuth client secrets, Supabase service role). Prefer machine-local userData/.env for operators who can inject secrets at install time; rotate anything that was ever packed into a public Release artifact
• Desktop generates a per-install AUTH_SECRET in userData on first run (does not copy a shared packed secret for new installs)
• StackUp does not store Discord or Google OAuth access/refresh tokens. Sign-in uses OAuth only to verify identity; we keep provider user IDs (and optional email) for account linking
• Session JWTs are scrubbed so provider tokens cannot ride in cookies; Google subject IDs and emails are not exposed on the client session
• Profile APIs return a redacted self-view (no trust_flags, Stripe IDs, or Google ID)
• Edge proxy.ts blocks scanner probes, cross-origin mutating API calls, and floods IPs (auth/admin/runtime write caps)
• Failed sign-ins escalate to progressive lockouts (minutes → hours)
• Mutating APIs reject oversized JSON and non-UUID/safe IDs
• Process-local rateLimit is best-effort on multi-instance serverless — prefer a shared store (e.g. Upstash Redis) if you scale horizontally
• Set TRUST_PROXY=1 (or deploy on Vercel) so rate limits use real client IPs; otherwise spoofed X-Forwarded-For is ignored
• Restrict ADMIN_DISCORD_IDS to trusted operators only; banned admins lose ops access
• OAuth trust gates reject disposable emails, unverified Google emails, Discord bots, banned users, and Discord accounts younger than AUTH_MIN_DISCORD_AGE_DAYS
• Desktop Google finish requires a single-use server-issued loginState; assertions are single-use (~30s TTL)
• Accounts are not auto-merged by email across Discord/Google — sign in with the original provider
• Rotate Discord bot tokens if leaked; enable GitHub secret scanning push protection on forks/clones where possible
• Apply Dependabot security updates promptly
• Never commit certificate.pfx / *.pfx.base64 signing material