We release patches and security fixes for the latest version on the main branch.

We take the security of GitDNA and user data seriously. If you discover a security vulnerability, please report it privately rather than opening a public GitHub issue.

Send an email to the project maintainer:

• Contact: Mrinal Prakash
• Email: mrinalprakash9123@gmail.com
• Subject line: [SECURITY VULNERABILITY] GitDNA - <Brief description>

Include the following details in your report:

1. Type of issue (e.g. SQL injection, privilege escalation, cross-site scripting, SSRF).
2. Location of the vulnerable code (file path and line numbers).
3. Step-by-step instructions or proof of concept to reproduce the issue.
4. Potential impact of the vulnerability.
5. Suggested remediations, if known.

• Initial confirmation: Within 48 hours of receipt.
• Triage and assessment: Within 5 business days.
• Fix and disclosure: We coordinate disclosure dates once a fix is prepared and validated.

Please allow reasonable time for the maintainer to address the vulnerability before publishing details publicly.

• Never commit real credentials or .env files to git repositories.
• Use Supabase Row Level Security (RLS) policies on all tables.
• Keep SUPABASE_SERVICE_ROLE_KEY strictly inside server functions and never import it into client-facing route files or hooks.
• Use GitHub personal access tokens with fine-grained read-only permissions for public repositories.