Security

Reporting a vulnerability

Report vulnerabilities privately, not in a public issue: on GitHub, open the repository’s Security tab and choose Report a vulnerability (direct link). If you can’t use GitHub, email ben@benjuntilla.com.

Say what you found, how to reproduce it, and what an attacker could do with it. The maintainer acknowledges reports within 7 days, then publishes a fix and an advisory after confirming the problem.

Scope

The code in this repository and the public instance at hardcover.benjuntilla.com, which runs the latest main. Problems in Hardcover itself belong with Hardcover.

Testing the public instance

Use only your own Hardcover account, don’t access anyone else’s data, and don’t load-test it. The maintainer won’t pursue good-faith research that follows these rules and that you report privately.