Please do not open a public issue for security problems.

Report privately through GitHub: Security → Report a vulnerability on this repository (https://github.com/Haseeb-MernStack/commune/security/advisories/new). Include what you found, how to reproduce it and the impact. You will get a first answer within a few days. Please give us reasonable time to fix the problem before disclosing it.

In scope: the API, the web app and this repository's configuration. Out of scope: denial of service by volume, social engineering, and vulnerabilities in third-party services (report those to the provider).

Only the latest main branch is supported.

How the project is hardened is described in docs/SECURITY.md.