AgoraHub is alpha software. Security fixes are provided on a best-effort basis for the latest 0.2.0-alpha line only. Older snapshots and forks are not supported.

Do not open a public issue. Use the repository's Security → Report a vulnerability flow to create a private GitHub Security Advisory. If that is unavailable, email hello@agorahub.dev with the subject AgoraHub security report.

Include:

• affected commit/version and deployment mode;
• a minimal reproduction or proof of concept;
• impact and required preconditions;
• whether credentials or user data may be exposed;
• a safe contact method.

Do not access data you do not own, degrade the public service, run denial-of-service tests, or publish details before coordinated disclosure. Please use synthetic accounts and redact secrets from evidence.

This project has no formal SLA. The maintainer will acknowledge actionable reports when available, validate impact, coordinate a fix, and credit reporters who want attribution. Critical reports may require credential rotation, release replacement, or deployment downtime.

Self-hosters are responsible for TLS, GitHub OAuth configuration, secret storage, database backups, migration verification, network controls, dependency updates, and monitoring. Use a unique AUTH_SECRET, strong PostgreSQL credentials, and explicit NEXT_PUBLIC_APP_URL/NEXTAUTH_URL values. Never expose PostgreSQL publicly.