IssueFit is pre-alpha. Only the latest state of the main branch is supported.
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Report vulnerabilities privately using one of:
- GitHub private vulnerability reporting — use Security → Report a vulnerability on the repository (preferred).
- Email — msesay@dee-empire.com with the subject line
IssueFit security report.
Include as much of the following as you can:
- A description of the vulnerability and its impact.
- Steps to reproduce, ideally with a proof of concept.
- Affected components (web app, worker, database package, CI).
- Any suggested remediation.
- Acknowledgement of your report within 72 hours.
- A status update within 7 days, including an initial severity assessment.
- Credit in the release notes once a fix ships, unless you prefer to remain anonymous.
Please give us reasonable time to fix the issue before any public disclosure.
- Secrets must never be committed to the repository; report any committed secret immediately.
- GitHub webhook payloads are only trusted after signature verification.
- AI-generated output is treated as untrusted input and validated before use.