Please do not open a public issue, discussion or pull request for a security problem.

Report it privately through GitHub: on this repository's Security tab, choose Report a vulnerability. Include what you found, how to reproduce it, and what an attacker could do with it. The report is visible only to you and the maintainers.

You will get an acknowledgement, be kept informed while the problem is being fixed, and be credited in the advisory if you wish.

Only the latest revision of the default branch receives security fixes.

This application handles GitHub App credentials, OAuth tokens and the enrolled employees' email addresses. Reports about any of these, or about the dashboard's access control, are especially welcome. Vulnerabilities in a dependency belong upstream, unless this application uses the dependency in a way that makes it exploitable.