Please do not publish suspected vulnerabilities as public GitHub issues.
If you discover a security issue, send a concise report to arda@codewithmad.com with:
- affected component or endpoint
- reproduction steps
- expected vs. observed behavior
- potential impact
- screenshots or proof-of-concept details when appropriate
Avoid including real credentials, personal data, production records or destructive payloads in reports.
Security-sensitive areas include authentication, authorization, session handling, file access, uploads, exports, backup/restore operations, request validation and database interactions.
The project uses defensive measures such as CSRF protection, prepared database queries, output encoding, access controls, security headers and static-analysis driven remediation. Security controls should still be reviewed before every production deployment.
Please allow reasonable time for investigation and remediation before publicly disclosing a vulnerability.