Latest supported application version: v02.25.05. The current main branch is supported for security fixes until the next internal version is deployed.
Please do not open a public issue for suspected vulnerabilities, credential leaks, private data exposure, authentication bypasses, payment-flow issues, supply-chain issues, or deployment misconfiguration.
Report privately by email:
If GitHub private vulnerability reporting is enabled for this repository, that channel is also acceptable.
Please include:
- affected repository, component, route, package, workflow, or public surface;
- affected internal version, commit SHA, or deployment URL when known;
- impact and exploitability;
- reproduction steps or a safe proof of concept, if available;
- whether any credential, personal data, payment data, private editorial material, or operational secret may be involved.
In scope: application code, Workers/Pages functions, package and dependency configuration, GitHub Actions, supply-chain configuration, repository publication boundaries, security documentation, and public service configuration documented in this repository.
Out of scope: social engineering, physical attacks, denial-of-service testing without prior written authorization, spam, automated noisy scanning, and reports that rely only on outdated browser or dependency versions without a concrete vulnerable path in this repository.
LCV Ideas & Software will triage reports privately, request clarification when needed, and coordinate remediation before public disclosure. Public disclosure should wait until a fix or mitigation is available, unless there is an immediate user-safety reason to do otherwise.