Security fixes go into the latest release only. Update to the newest ghcr.io/app-torq/torq image before reporting.

Please do not open a public issue. Report it privately through GitHub instead:

1. Open the Security tab of the affected repository (for the app: app-torq/torq).
2. Click Report a vulnerability and describe the issue, the affected version and how to reproduce it.

You will get an answer within a week. Once a fix is released, the advisory is published and you are credited unless you ask not to be.

In scope: the torq application and its container image. Out of scope: the public demo at demo.torq-app.tech (it is reset nightly and runs in demo mode with accounts, webhooks and uploads locked), denial of service, and findings that need an already compromised server or administrator account.