Security updates are applied to the latest deployed version of Planwell. Older commits, forks, and unsupported deployments may not receive fixes.

Report suspected vulnerabilities through GitHub private vulnerability reporting.

Do not disclose a suspected vulnerability in a public issue, discussion, pull request, or other public channel.

Include the affected area, reproduction steps, potential impact, and any known mitigation. Remove credentials, personal data, and other secrets from reports.

We aim to acknowledge reports within three business days and provide a status update within seven business days. Please allow reasonable time for a fix before public disclosure.

Reports should concern Planwell application code or its deployment. Vulnerabilities in third-party services should be reported directly to the relevant provider unless they result from Planwell's integration with that service.