| Version | Supported |
|---|---|
latest main |
Yes |
| older tags | Best-effort only |
Do not open a public issue for security vulnerabilities.
Instead, email security@oequ.dev with:
- Description of the vulnerability.
- Steps to reproduce or a proof of concept.
- Impact assessment (what an attacker could do).
We will acknowledge receipt within 48 hours and aim to provide a fix or mitigation within 7 days for critical issues.
This repository is a starter kit — security posture depends on how you deploy it.
| Area | Starter default | Production recommendation |
|---|---|---|
| Auth tokens | Supabase localStorage JWT |
HttpOnly cookies or BFF pattern |
| CSP | <meta> tag, unsafe-inline |
Strict CSP via HTTP headers + nonces |
| CSRF | Not configured | withXsrfConfiguration for cookie-based APIs |
| Authorization | Supabase RLS | RLS + server-side validation |
| Route guards | UX-only navigation | Backend enforces all access control |
We follow coordinated disclosure. Reporters will be credited in the changelog unless they prefer anonymity.