Please do not report security vulnerabilities through public GitHub issues.

Instead, please privately report a vulnerability through GitHub Security Advisories.

To maintain the security of Orbit and its users:

• Do not create public issues for security vulnerabilities
• Do provide detailed steps to reproduce the vulnerability
• Do include your contact information for follow-up
• Do include enough information for maintainers to reproduce the issue

Only the latest stable release receives security updates.

Orbit follows these security best practices:

• Input Validation: All user inputs are validated and sanitized
• SSRF Protection: External API calls use allowlisted hosts only
• CSP Headers: An app-wide Content Security Policy limits permitted resources
• No Tracking: Zero analytics or user tracking
• Client-Side Only: No server-side data storage
• HTTPS Everywhere: All API calls use encrypted connections

When we receive a security bug report, we will:

1. Acknowledge and validate the report through GitHub Security Advisories
2. Work with the reporter to understand and reproduce the issue
3. Develop and test a fix
4. Publish a release and disclosure when a fix is available

Security researchers who responsibly disclose vulnerabilities will be credited in our release notes (unless you prefer to remain anonymous).

Thank you for helping keep Orbit secure! 🔒