Security fixes are provided for the latest 2.x release. Older major versions are unsupported; upgrade before requesting a backport.

Please use GitHub private vulnerability reporting. If that is unavailable, email haris.ahmed@code-huddle.com with the subject nextjs-boilerplate-kit security report.

Include:

• the affected generator version and options;
• the generated file or route involved;
• reproduction steps or a minimal proof of concept;
• impact and prerequisites;
• any suggested fix or disclosure constraints.

Do not open a public issue before a fix or coordinated disclosure. Do not access data you do not own, perform denial-of-service testing, or retain credentials or personal data encountered during research.

We aim to acknowledge complete reports within five business days. Fix and disclosure timing depends on severity, reproducibility, upstream dependencies, and release coordination. We do not currently operate a paid bug bounty.

The project provides generated starter code, not a hosted service. Reports about the generator and unmodified generated output are in scope. Vulnerabilities introduced by an application's later customization or deployment are normally the responsibility of that application owner, though clear hardening proposals are still welcome.

Generated code protects the role-specific Supabase pages, verifies Stripe webhooks, keeps Stripe price/customer decisions server-side, and uses server-validated Supabase claims. Generic ORM and email demo APIs are not automatically authenticated or owner-scoped. Application teams must add the authorization policy, validation, rate limits, abuse controls, data classification, RLS policies, monitoring, backups, and deployment review their product requires.