OpenTracker takes the security of its users and their trading data seriously. This document describes how to report vulnerabilities and what to expect in return.

Because the project is in active beta, only the latest main branch and the most recent release receive security fixes.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please use GitHub's private vulnerability reporting:

1. Go to the repository Security tab.
2. Click Report a vulnerability.
3. Provide a clear description, steps to reproduce, and the impact.

If you prefer email, contact the maintainers directly. You will receive an acknowledgement within 72 hours. Please do not disclose the vulnerability publicly until a fix has been released.

• A description of the issue and its impact
• Steps to reproduce, including any relevant environment details
• Affected files or routes, if known
• A suggested fix, if you have one

In scope:

• Authentication or authorization bypass (NextAuth, sessions, 2FA)
• SQL injection or Prisma query abuse
• Cross-site scripting (XSS) in any page or component
• Insecure direct object reference (IDOR) in API routes
• Secrets or credentials exposed in client bundles
• Insecure defaults in configuration

Out of scope:

• Self-hosted deployments exposed to the public internet without authentication (secure your own deployment)
• Vulnerabilities in third-party dependencies already disclosed as CVEs with a published fix — report these upstream and update via npm audit
• AI provider API key leakage caused by a user committing their own key to a public fork

1. We acknowledge the report and confirm reproduction.
2. We develop and test a fix on a private branch.
3. We release a patch and publish a GitHub Security Advisory.
4. We credit the reporter (unless they prefer to remain anonymous).

If you self-host:

• Keep NEXTAUTH_SECRET long and random. Generate with openssl rand -base64 32.
• Never commit .env.local or real API keys to git.
• Run behind HTTPS in production.
• Restrict your Supabase database to your deployment IP range when possible.
• Set AI_PROVIDER to a real provider only when you have supplied the corresponding key. The mock provider never makes external calls.

OpenTracker is a journaling and analytics tool. It is not financial advice and does not execute trades. Security issues that result purely from a user violating their prop firm rules are not security vulnerabilities.