LearnHub takes security issues seriously. If you find a vulnerability, please report it privately instead of opening a public issue or pull request.

LearnHub is currently developed on the main branch.

Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Please report them privately by email:

[email protected]

Include whatever information you have, such as:

• What the vulnerability is.
• How to reproduce it.
• The affected file, route, or feature.
• The possible impact.
• Relevant screenshots, logs, or proof of concept.

Security reports will be reviewed privately.

Depending on the issue, we may:

• Ask for additional details.
• Confirm the issue and work on a fix.
• Apply a temporary mitigation.
• Close the report if it is not a security issue or cannot be reproduced.

Please avoid publicly sharing details of the vulnerability while it is being investigated.

This includes issues such as:

• Authentication or authorization problems.
• Exposure of sensitive data.
• Injection vulnerabilities.
• Unsafe file uploads.
• Vulnerable dependencies.
• Leaked secrets or credentials.
• Issues that could affect the confidentiality, integrity, or availability of LearnHub.

Please give the maintainers reasonable time to investigate and fix a reported vulnerability before making the details public.

Thank you for helping keep LearnHub and its contributors safe.