We take the security of Clawfy seriously — it handles billing, API keys, and provisions real servers. Thank you for helping keep it and its users safe.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, report them privately via one of:

• Email: ucfyao@gmail.com (subject: SECURITY: <short summary>)
• GitHub Security Advisories: Report a vulnerability (preferred — keeps the report private and threaded)

Please include:

• A description of the vulnerability and its impact.
• Steps to reproduce (proof-of-concept, affected endpoint/file, or request).
• Any suggested remediation, if you have one.

• Acknowledgement within 72 hours.
• An assessment and, if confirmed, a remediation timeline.
• Credit in the release notes once a fix ships, unless you prefer to remain anonymous.

Areas we care most about:

• Authentication / authorization bypass (Supabase RLS, admin routes).
• Billing and credit manipulation (/api/chat, increment_balance, Stripe webhook).
• Server provisioning and SSH config injection (src/lib/ssh.ts, provisioning.ts).
• Leakage of platform-managed API keys or other tenants' data.

• Vulnerabilities in third-party dependencies already disclosed upstream.
• Issues requiring physical access to a self-hoster's own infrastructure.
• Findings from automated scanners without a demonstrated, realistic impact.

Clawfy is self-hostable. You are responsible for securing your own deployment — rotate the keys in .env, restrict your Supabase service-role key, and keep CRON_SECRET private. Never commit a real .env file.