If you discover a security vulnerability, please do not open a public issue. Instead, email the maintainers at khanhackersalman@gmail.com with:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested remediation

We aim to acknowledge reports within 48 hours and provide a resolution timeline after triage.

• Secrets are managed via environment variables only — never hardcoded.
• Authentication uses NextAuth with JWT and bcrypt-hashed passwords.
• Role-based access control (RBAC) guards privileged routes.
• Input is validated with Zod on every API boundary.
• Rate limiting (Upstash) protects auth and AI endpoints.
• Security headers (HSTS, X-Frame-Options, etc.) are set globally.
• Dependencies are monitored via Dependabot.

We support coordinated disclosure and will credit reporters who follow this policy, unless they prefer to remain anonymous.