Space Works apps hold members' personal data, payment records and access to real workshops, so we take security reports seriously. This policy covers every repository in SpaceWorks-HQ.

Please don't open a public issue, discussion or pull request for a vulnerability.

Report it privately in either of these ways:

1. GitHub private vulnerability reporting (preferred). Open the affected repository's Security tab and choose Report a vulnerability.
2. Email shaanshoukath4522@gmail.com with "Security" in the subject line.

Please include:

• the affected repository and version, tag or commit,
• steps to reproduce, or a proof of concept,
• the impact you think it has (for example, data from one space visible to another),
• any suggested fix, if you have one.

• We aim to acknowledge your report within 3 working days.
• We'll confirm the issue, agree a fix and a disclosure timeline with you, and keep you updated.
• Once a fix is released we'll publish an advisory and, if you'd like, credit you for the report.

Please give us reasonable time to fix the issue before disclosing it, and don't access, change or delete other people's data while testing. Test against your own installation, never someone else's live space.

Security fixes land on main and ship in the next release of the affected app. Older releases are supported on a best-effort basis, so please keep self-hosted installs up to date. The SpaceWorks installer can update from GitHub releases for you.