skillgrowth is a single rolling release — there's no LTS or backport policy. Security fixes land on main and go out in the next tagged release. Only the latest release is supported; please upgrade before reporting an issue that might already be fixed.

Please report security issues privately using GitHub's private vulnerability reporting for this repository, rather than opening a public issue. If that isn't available to you, open a regular issue with as little sensitive detail as possible and ask to be contacted privately.

Include what you'd include in any good bug report: the affected version, steps to reproduce, and the impact you'd expect (e.g. what an attacker could read, modify, or execute).

This is a single-maintainer project — there's no fixed SLA, but reports are read and acknowledged as soon as possible.

skillgrowth is meant to be run as a single-user, self-hosted instance (see "Design choices" in README.md). Reports about the app's behavior when deliberately exposed to multiple untrusted users, or about the absence of authentication/multi-tenancy when the optional HTTP Basic Auth gate (SKILLGROWTH_BASIC_AUTH_*, off by default — see README's "Optional access gate") is left unset, are expected and out of scope — that's a documented design choice, not a vulnerability. Reports about things that go wrong even for the single trusted owner of an instance (e.g. data exposure to that instance's own frontend, injection, path traversal, unsafe file handling, or a way to bypass the Basic Auth gate when it is configured) are in scope.