Security fixes are provided for the latest tagged release and the default branch.

Please use GitHub private vulnerability reporting when enabled. If it is unavailable, contact the repository maintainer privately through the address listed on their GitHub profile.

Do not open a public issue containing:

• credentials or session tokens
• merchant or customer data
• Wi-Fi passwords
• private deployment URLs
• a working exploit against a public instance

Include the affected version, reproduction steps, impact and any suggested mitigation. You should receive an initial response within seven days.

• Set ALLOW_DEMO_ADMIN=false in production.
• Use a unique strong ADMIN_PASSWORD and EVENT_SALT.
• Put the Node service behind HTTPS.
• Do not expose the Node port directly to the Internet.
• Use a guest Wi-Fi network for public Wi-Fi sharing.
• Keep runtime data and uploads outside the source repository.
• Review uploads, disk use and event retention regularly.