Please do not open a public issue. Use GitHub's private vulnerability reporting instead: Report a vulnerability (tab Security → Report a vulnerability).

Helpful details: affected component (backend, app, engine, MQTT), version or commit, steps to reproduce and the possible impact. I usually acknowledge receipt within a few days; FoxGrid is a volunteer project, so deadlines are guidelines.

Only the current state of main and the latest release are supported.

Guidance for secure operation (invite links, approval, rate limits, reverse proxy) is in docs/user-guide/mission-lead-security.md and docs/operations/deployment.md. Secrets never belong in the repository; .env is ignored, .env.example contains placeholders only.