Security

Security

Reporting a vulnerability

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report them privately by email to:

security@forgemind.in — subject line: SECURITY: <short summary>

What to include

• A description of the vulnerability and its potential impact.
• Step-by-step instructions to reproduce it.
• The affected version, commit hash, or deployment URL.
• Any proof-of-concept code, requests, or screenshots.
• Whether the issue is already publicly known or being exploited.

What to expect

Stage	Target
Acknowledge your report	within 3 business days
Initial triage & severity assessment	within 7 days
Coordinated public disclosure (after a fix is available)	within 90 days

You'll be kept informed of progress and credited in the disclosure if you wish. Full scope and safe-harbour terms are in SECURITY.md.

Keep your own instance secure

Because you self-host ForgeChat, you're responsible for your deployment. At a minimum:

• Never commit backend/.env or any secret. Keep FORGECRM_ENCRYPTION_KEY, JWT_SECRET, and META_WEBHOOK_VERIFY_TOKEN secret and unique.
• Keep your Meta access tokens private (ForgeChat stores them encrypted at rest with AES-256-GCM).
• Serve only over HTTPS/TLS, and never expose your PostgreSQL or Redis ports publicly.
• Keep ForgeChat, its dependencies, and the base Docker images up to date.

---

See also: Contributing • Configuration & Environment Variables • FAQ