This repository is the target codebase for a hackathon challenge. It is meant to run locally and is not hardened for production or for exposure to the internet. The seeded users, the demo passwords, and the development JWT secret in .env.example are all intentional and are safe only because everything runs on your own machine.

The pr/document-sharing branch is the challenge itself. The changes on it were written to be reviewed, and some of the problems in them are planted on purpose, including problems in how access to a shared document is checked. Please do not report those as vulnerabilities. Finding them, and proving them, is the exercise.

If you find something that matters outside of that branch, including anything that would affect people running this locally, email contact@vindler.solutions with the details and how to reproduce it. Please do not open a public issue for a security problem.

We will acknowledge within three business days and tell you what we plan to do about it.