Skip to content

Repository navigation

Security: smadrom/basalt

Security

SECURITY.md

Security Policy

Reporting a vulnerability

Please do not open a public issue for security vulnerabilities.

Instead, report privately via GitHub Security Advisories. You can expect an acknowledgement within a few days.

Scope

Basalt is a starter template. The most security-relevant areas are:

  • Auth (apps/api/src/auth) — Better Auth configuration, bearer-token handling.
  • Database access (apps/api/src/db, route handlers) — query construction.
  • Secrets — never commit a real .env; .env.example holds placeholders only.

The API rejects the example BETTER_AUTH_SECRET when NODE_ENV=production. Replace it and all database credentials before deploying.

There aren't any published security advisories