Only the latest published release receives security patches. Users are encouraged to always run the latest version.

Report vulnerabilities via GitHub's private vulnerability reporting:

1. Go to the repository's Security tab
2. Click "Report a vulnerability"
3. Fill in the details — no account needed beyond a GitHub account

This ensures the report is only visible to repository maintainers until a fix is released.

A good report helps us respond quickly:

• Description — what kind of issue is it? (XSS, data leak, rate limit bypass, etc.)
• Steps to reproduce — exact requests, payloads, or configuration
• Impact — what could an attacker achieve?
• Environment — Cloudflare Workers, VPS/standalone, or both

We ask that you do not disclose the vulnerability publicly until a fix has been released and the release is published.

The following components are covered by this policy:

• Worker handler — src/index.ts, src/server.ts, and all files in src/
• Client script — dist/simplelikes.js (source in src/client/)
• Database schema and queries — src/db/schema.sql and storage adapters (src/storage/)
• CORS, rate limiting, and validation logic — src/utils/

The following are not covered by this policy. Please report issues to the respective project:

• Cloudflare Workers / D1 infrastructure — report to Cloudflare HackerOne
• Third-party dependencies — report to the respective project (see package.json)
• VPS/standalone deployments — these are the user's own infrastructure; vulnerabilities in the simplelikes code running there are in scope, but OS-level or network-level issues are not