Talk With Data handles authentication, embed tokens, database credentials, and user-uploaded content. Weaknesses in these areas put every self-hosted deployment at risk, so we ask for private, responsible disclosure.

Talk With Data is pre-1.0 software. Before the first non-prerelease GitHub Release is published, there is no supported version. The main branch is development-only and is not a release channel.

After releases begin, support follows this rolling policy:

There are no maintenance branches and no backports. Security fixes land on main first and become supported only when they are published in a new non-prerelease GitHub Release. Self-hosters must update to the latest supported release to receive security fixes. A repository tag or package version without a corresponding GitHub Release is not a supported release.

Critical fixes are prioritized for an expedited release, subject to maintainer availability. This volunteer-maintained project does not guarantee a release schedule or compatibility between pre-1.0 releases.

Report vulnerabilities privately through GitHub Private Vulnerability Reporting:

1. Open https://github.com/guifav/TalkWithData/security/advisories/new
2. Or go to the repository Security tab and click "Report a vulnerability".

Do not open a public issue, pull request, or discussion for a security problem, and do not post exploit details in public comments.

• The affected area, for example an API route, a library file, or a feature such as embed tokens or dashboard upload.
• The type of issue, for example XSS, authorization bypass, token forgery, SSRF, or injection.
• Step-by-step reproduction instructions or a proof of concept.
• The impact, meaning what an attacker can read, change, or execute.
• The commit hash you tested against.
• A suggested fix, if you have one.

• We aim to acknowledge your report within 5 business days.
• We aim to provide an initial assessment and severity triage within 14 days.
• A fix plan and timeline after triage. Critical issues are prioritized.
• Credit in the published advisory, unless you prefer to stay anonymous.

Please keep the details private until a fix is released. We aim to publish a fix and an advisory within 90 days of a valid report, sooner for critical issues.

This is a volunteer-maintained open source project. There is no bug bounty program.

In scope:

• Authentication and session handling, including Firebase sign-in and dashboard session cookies.
• Authorization, including admin routes, department access, and shared folders.
• Embed token generation and validation.
• Rendering and serving of user-uploaded HTML dashboards.
• Dashboard upload handling for HTML files and ZIP packages.
• Data file parsing for Excel (.xlsx) and Markdown files.
• Server-side handling of AI provider API keys and database credentials.
• Relational database access through Prisma, including raw query construction and row-level authorization.
• Firestore security rules in this repository.
• Server-side request handling, including MCP host access and dashboard refresh.

Out of scope:

• Vulnerabilities in third-party dependencies without a demonstrated impact on this project. Report those upstream.
• Misconfiguration of individual self-hosted deployments, for example exposed .env files or a publicly reachable database.
• Denial of service through high traffic volume.
• Social engineering and physical attacks.
• Reports from automated scanners without a validated proof of concept.

Only test against deployments you own or have permission to test.