Please report vulnerabilities privately through GitHub's private vulnerability reporting. Do not open a public issue.

Include what you found, how to reproduce it, the affected version or commit, and, if possible, the X-Request-Id of a relevant response. You can expect an acknowledgement within 5 working days and a status update at least every two weeks until the issue is fixed. Please give a reasonable time to fix the issue before disclosing it.

In scope: the API (server/), the web client (client/), the container images and the deployment configuration in this repository.

Out of scope: denial of service by volume, findings that require a compromised device or browser, missing headers without a demonstrated impact, and reports produced only by automated scanners.

There is no public deployment of Wisely; please test against a local instance (docker compose up), never against infrastructure you do not own.

• The application is served over HTTPS behind the provided Caddy configuration (or an equivalent proxy that overwrites X-Forwarded-For).
• Secrets (JWT_SECRET, database and SMTP credentials) are supplied through the environment and are never committed.
• PostgreSQL is reachable only from the application network.
• /metrics and Swagger are not exposed to the internet in production.

The security model is described in docs/security.md.

Commit c9c6c46 (April 2025) hard-coded the password of a hosted PostgreSQL (Aiven) database in server/src/app.module.ts, and it remains in later historical commits of that file. The repository history is public, so the credential must be considered leaked. The password must be rotated at the provider, or the database deleted; removing it from the current code or rewriting history is not enough. This file will be updated once the owner has confirmed the rotation. The v1 code reads every credential from the environment.

server/src/ca.pem in the pre-v1 code was a public CA certificate, not a secret.