| Version | Supported |
|---|---|
Latest (master) |
✅ |
| Older releases | ❌ |
Do not open a public GitHub issue for security vulnerabilities.
Use GitHub's built-in private advisory mechanism:
- Go to the Security tab of this repository.
- Click "Report a vulnerability".
- Fill in the details — affected component, steps to reproduce, and potential impact.
- Submit. Maintainers will be notified privately and will respond within 72 hours.
If the Security tab is disabled or inaccessible, email the maintainer directly:
- @SandeepVashishtha — raise a GitHub private advisory or contact via the email listed on the profile page.
Encrypt sensitive details if possible. Do not share reproduction steps or proof-of-concept code in any public channel until a fix is released.
- Affected file(s), module, or endpoint
- Steps to reproduce the vulnerability
- Potential impact (data exposure, privilege escalation, DoS, etc.)
- Your suggested fix or mitigation (optional but appreciated)
- Maintainers will acknowledge receipt within 72 hours.
- A fix target will be communicated within 7 days of confirmation.
- Public disclosure will happen only after a patch is released, coordinated with the reporter.
- Credit will be given to the reporter in the release notes unless anonymity is requested.
- Vulnerabilities in dependencies (report upstream; open a public issue here to track)
- Issues requiring physical access to a device
- Social engineering attacks
- Enforce secure cookie attributes for persistent auth sessions.
Eventra performs a lightweight validation of important client-side security configuration during application startup.
The validator checks:
- HTTPS API endpoint configuration
- Required environment variables
- Authentication configuration
- Content Security Policy (CSP) presence
The validation utility reports configuration warnings during development to help contributors identify missing or insecure settings. It complements existing backend security controls and should not be considered a replacement for server-side validation.
Eventra sanitizes payloads sent through shared client-side logging utilities before they are written to the console or persisted in browser storage.
The redaction utility covers:
- JWT tokens embedded in messages or metadata
- Password fields and password-like inline values
- API key fields and API-key-like inline values
- Authorization headers, including bearer/basic/token values
- Email addresses in free-form strings
Sensitive object keys such as password, apiKey, authorization, accessToken, refreshToken, jwt, secret, and similar variants are replaced with redaction placeholders. This reduces accidental exposure in development logs, but contributors should still avoid intentionally logging credentials or personally identifiable information.
For general bugs or feature requests, open a regular GitHub issue.