This policy applies to every repository in the LikeMindsCommunity organisation.

Please do not open a public issue.

Email natesh@likeminds.community with SECURITY in the subject line. Include:

• Which repository and version
• What the issue is, and what an attacker could do with it
• Steps to reproduce, or a proof of concept
• Any suggested fix, if you have one

We will acknowledge your report and keep you updated as we investigate. Once a fix is released we are happy to credit you, unless you would rather stay anonymous.

Please give us a reasonable window to ship a fix before disclosing publicly.

Everything in the organisation is in scope. The parts most worth your attention:

• likeminds-kettle is the client-facing API gateway and handles authentication: OTP, social login, JWT issue and refresh, account merge, device registration, and rate limiting.
• likeminds-skulk handles subscriptions, payments, settlements and KYC.
• The data layers hold auth tokens and manage local persistence on user devices.
• likeminds-caravan, likeminds-swarm and likeminds-pandemonium serve chat, feed and realtime traffic.

Findings we are particularly interested in: authentication or authorisation bypass, token leakage, one community reading another community's data, injection, and anything that lets a non-manager perform a moderation action.

• Reports generated by an automated scanner with no demonstrated impact
• Vulnerabilities in third-party dependencies with no exploitable path in our code, though we would still like to hear about them
• Findings that require a compromised device or a self-hosted misconfiguration
• The sample and reference apps in the repositories, which are illustrative and not intended for production

Several of these repositories were public for some time before this policy existed. If you find a credential or key in git history, please report it via the address above rather than opening an issue, so it can be rotated.