Security

SECURITY.md

Security Policy

Supported versions

Version	Supported
3.0.x	Yes
< 3.0	No

Reporting a vulnerability

Please do not open public GitHub issues for security vulnerabilities.

Open a private security advisory on this repository, or email the maintainer listed in the repository profile.
Include steps to reproduce, impact, and affected routes or components.
Allow reasonable time for a fix before public disclosure.

Secrets

Never commit .env, .env.local, API keys, or JWT secrets.
Use API_INTERNAL_URL server-side only (BFF); do not expose the NestJS API directly to browsers in production.
Rotate JWT_* secrets and seed passwords before any public deployment.

More detail

See docs/SECURITY.md for BFF cookies, CSRF, MFA, and production hardening.

There aren't any published security advisories