Please don't open a public issue for a security problem. Report it privately through GitHub's Report a vulnerability button (this repository's Security tab), or email the contact listed on the /security page of the instance you found it on.

Include what you found, how to reproduce it, and what an attacker could do with it. You'll get an acknowledgement within 2 business days. Once a fix is deployed, we're glad to credit you, if you'd like.

This covers the code in this repository. Each running instance of FOQB is operated by whoever deployed it; its /security page names them and how to reach them. Issues in Supabase, Vercel, Plaid or other dependencies belong with those projects, though we'd like to hear if FOQB uses one unsafely.

Only the latest commit on main gets security fixes.