Do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability in the Lean Storytelling App, please report it privately to our security team:

Email: security@leanstorytelling.app GPG Key: Download our public GPG key

When reporting a vulnerability, please include:

1. A clear description of the vulnerability
2. Steps to reproduce the issue
3. Any relevant proof-of-concept code
4. Your contact information (optional)
5. Any potential mitigations you've identified

1. Acknowledgment: You will receive an acknowledgment of your report within 48 hours
2. Assessment: Our security team will assess the vulnerability and determine its impact
3. Resolution: We will work on a fix and provide you with updates on our progress
4. Disclosure: After the vulnerability is fixed, we will publicly disclose it (with credit to you, unless you prefer to remain anonymous)

Only the latest major version of the Lean Storytelling App receives security updates. We recommend always using the latest version.

• Always use the latest version of the application
• Use strong, unique passwords
• Enable two-factor authentication when available
• Regularly review your account activity
• Report any suspicious activity immediately

• Follow our Contribution Guidelines
• Never commit sensitive information (passwords, API keys) to the repository
• Use environment variables for configuration
• Follow secure coding practices
• Keep dependencies updated

We follow a responsible disclosure policy:

1. Initial Report: Vulnerability is reported privately
2. Triage: We acknowledge receipt within 48 hours
3. Investigation: We investigate and develop a fix (typically within 7-14 days)
4. Patch: We release a security patch
5. Disclosure: We publicly disclose the vulnerability after users have had time to update

We would like to thank the following security researchers for responsibly disclosing vulnerabilities:

• [Your Name Here] - [Vulnerability Type]

For security-related questions that are not vulnerabilities, you can contact us at:

• General Security Questions: security-questions@leanstorytelling.app
• GPG Fingerprint: ABCD 1234 EFGH 5678 IJKL MNOP QRST UVWX YZ

Thank you for helping keep the Lean Storytelling App and its users safe!