Where this file is silent, the laranail security policy applies.

We release patches for security vulnerabilities for the latest minor release.

Please do not report security vulnerabilities through public GitHub issues.

Instead, report them via email to security@simtabi.com.

You should receive a response within 48 hours. If you do not, please follow up to ensure we received your original message.

Please include as much of the following as you can, to help us triage quickly:

• Type of issue (e.g. path traversal, SQL injection, XSS, SSRF, etc.)
• Full paths of the source file(s) involved
• The location of the affected code (tag/branch/commit or direct URL)
• Any configuration required to reproduce
• Step-by-step reproduction instructions
• Proof-of-concept or exploit code (if possible)
• Impact, including how an attacker might exploit the issue

Prefer GitHub private vulnerability reporting when you can: open it from this repository's Security tab. The report arrives attached to the repo with a draft advisory and a CVE request path already in place. Email is the fallback for anyone who would rather not use GitHub.

We follow Coordinated Vulnerability Disclosure. We will acknowledge your report within 48 hours, keep you updated on progress, develop and test a fix, release a patched version, and then publicly disclose. Credit is given to reporters unless anonymity is requested.

1. Keep updated — always use the latest stable version.
2. Validate input — validate and sanitize user input before processing.
3. Use HTTPS in production.
4. File permissions — ensure proper file and directory permissions.
5. Secrets — never commit credentials; use environment variables.

Thank you for helping keep Laranail Toolkit and its users safe.