The Stock-Flow team takes the security of our application, user data, and infrastructure seriously. We appreciate the responsible disclosure of any security vulnerabilities by security researchers, developers, and the broader community.

This document outlines the supported versions of Stock-Flow, our security update policy, and instructions on how to report vulnerabilities responsibly.

We provide security updates and patches exclusively for the latest active release line. When a security vulnerability is identified, patches are applied to the active branch and published in the latest patch release.

Note: If you are running an older version (1.3.x or earlier), please upgrade to the latest patch release of the 1.4.x series to receive the latest security fixes and performance updates.

Please do not report security vulnerabilities via public GitHub issues, discussions, or pull requests.

The fastest and most secure way to report a vulnerability in Stock-Flow is through GitHub's Private Vulnerability Reporting feature:

1. Navigate to the repository on GitHub: https://github.com/EEMEEMMEEx/Stock-Flow
2. Click on the Security tab.
3. Select Advisories under "Reporting".
4. Click Report a vulnerability to open a confidential draft advisory directly to the maintainers.

This ensures that the discussion, proof of concept, and patch remain private until a fix is released.

To help us investigate, triage, and resolve the issue quickly, please provide as much relevant information as possible:

1. Summary & Impact: A clear description of the vulnerability, including the attack vector and the potential impact (e.g., unauthorized data access, privilege escalation, transaction tampering).
2. Affected Components: The affected URL, endpoint, page, API route, or source file (e.g., /api/r2-upload-url, src/pages/Withdrawals.jsx, RPC function).
3. Reproducible Steps: Detailed step-by-step instructions or a safe, non-destructive Proof of Concept (PoC) demonstrating the issue.
4. Environment & Version: The specific application version (e.g., v1.4.63), browser version, and OS where the issue was reproduced.
5. Mitigation Suggestion: Any suggested fix, code modification, or architectural mitigation (optional).

Safety Notice: Do not include sensitive production data, actual API keys, real database credentials, or personally identifiable information (PII) in your report. Use sanitized mock data and test accounts only.

When you submit a vulnerability report, the maintainers commit to the following workflow:

We ask all security researchers and contributors to follow responsible disclosure principles:

• Do No Harm: Do not attempt attacks that could cause denial of service (DoS), disrupt production services, corrupt inventory records, or access data belonging to other users.
• Test on Personal/Test Accounts: Limit testing to your own user account or local development instances (npm run dev).
• Maintain Confidentiality: Keep all details of the vulnerability confidential until a fix has been officially released and deployed.
• Give Reasonable Time: Allow the maintenance team reasonable time to investigate and address the vulnerability before sharing details publicly.

• Authentication bypass and privilege escalation (e.g., unauthorized Role-Based Access Control elevation).
• Database security, Row Level Security (RLS) bypasses, or SQL/RPC injection.
• Insecure Direct Object References (IDOR) affecting inventory, projects, or user accounts.
• Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF).
• Insecure serverless function endpoints or unauthorized object storage manipulation.
• Concurrency flaws or race conditions in atomic inventory deduction.

• Volumetric Distributed Denial of Service (DDoS) attacks.
• Spam, phishing, or social engineering targeting team members or users.
• Automated vulnerability scanner outputs without a verified, reproducible proof-of-concept.
• Issues requiring physical access to an unlocked or compromised user device.
• Missing security headers or informational findings that do not lead to demonstrable exploitation.