Thank you for helping keep FlagForge secure.

The security of our users and contributors is important to us. If you discover a security vulnerability, we ask that you report it responsibly so we can investigate and address the issue before it is publicly disclosed.

Security updates are provided for the latest stable release of FlagForge.

Older versions may not receive security patches, and users are encouraged to upgrade to the most recent release whenever possible.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report vulnerabilities privately by contacting the project maintainer.

Include as much information as possible:

• Description of the vulnerability
• Steps to reproduce
• Expected behavior
• Actual behavior
• Screenshots (if applicable)
• Proof of Concept (if available)
• Potential impact
• Suggested mitigation (optional)

The more information you provide, the faster the issue can be investigated.

After receiving a report, we aim to:

1. Acknowledge receipt within 7 days.
2. Investigate the reported issue.
3. Work on a fix if the vulnerability is confirmed.
4. Release a security update as soon as practical.
5. Credit the reporter (if they wish) in the release notes.

Response times may vary depending on the complexity of the issue and maintainer availability.

Please:

• Give maintainers reasonable time to investigate and fix the issue.
• Avoid publicly disclosing the vulnerability until a fix has been released.
• Avoid accessing or modifying data that does not belong to you.
• Avoid disrupting services or other users while testing.

We appreciate responsible security research and will work with reporters to resolve issues promptly.

The following are generally considered out of scope:

• Issues requiring physical access to a user's computer.
• Vulnerabilities caused by unsupported or modified versions of FlagForge.
• Social engineering attacks.
• Denial-of-Service (DoS) attacks.
• Issues in third-party software or dependencies that are outside the scope of this project.
• Low-impact issues that do not present a meaningful security risk.

FlagForge relies on several open-source libraries and frameworks.

If a vulnerability exists within a third-party dependency, please report it to both:

• The affected project's maintainers.
• The FlagForge maintainers if the vulnerability impacts FlagForge.

To help keep your installation secure:

• Always download releases from the official GitHub repository.
• Keep FlagForge updated to the latest version.
• Avoid opening untrusted files unless you understand the associated risks.
• Verify downloaded files when checksums or signatures are provided.
• Report suspicious behavior or unexpected application activity.

If you are unsure whether an issue qualifies as a security vulnerability, please contact the maintainer before opening a public issue.

We would rather investigate a false alarm than miss a legitimate security concern.

Thank you for helping make FlagForge more secure for everyone.