We release patches for security vulnerabilities for the following versions:

We take security seriously. If you discover a security vulnerability, please follow these steps:

Do NOT create a public GitHub issue for security vulnerabilities.

Instead, please report security issues by emailing: Use this repository's GitHub Security Advisories / private vulnerability reporting feature.

Your report should include:

1. Description — Clear explanation of the vulnerability
2. Steps to Reproduce — Detailed steps to reproduce the issue
3. Impact Assessment — Potential impact and severity
4. Suggested Fix — If you have recommendations (optional)
5. Your Contact Info — So we can follow up

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Varies by severity
  • Critical: 1-7 days
  • High: 7-30 days
  • Medium: 30-90 days
  • Low: Best effort

We appreciate responsible disclosure. With your permission, we'll:

• Credit you in our CHANGELOG
• List you in our security acknowledgments

1. Always use HTTPS when deploying
2. Keep dependencies updated (npm audit regularly)
3. Don't commit .env files with sensitive data
4. Use Content Security Policy headers
5. Validate user inputs if you fork and add backend features

This project uses localStorage for:

• User preferences (theme, language)
• Favorites list
• Vote history

Note: No sensitive data is stored. All data stays client-side.

We use CDN scripts for:

• Alpine.js (reactivity)
• i18next (internationalization)
• Supabase (optional backend)

All scripts use SRI (Subresource Integrity) hashes where available.

• ✅ No server-side code execution
• ✅ No database credentials in client code
• ✅ No authentication tokens stored insecurely
• ✅ CORS properly configured
• ✅ XSS protection via CSP headers (recommended)

Thank you for helping keep UI and AI secure! 🙏