Please report security vulnerabilities privately — do not open a public issue, pull request, or discussion for anything security-sensitive.

• Email: security@trygoldroad.com (abuse and content reports: abuse@trygoldroad.com).
• Alternatively, use GitHub's private Report a vulnerability flow on this repository.

Please include enough detail to reproduce: affected version/commit, a description of the issue and its impact, and reproduction steps or a proof of concept if you have one. We aim to acknowledge reports within a few business days.

Please act in good faith: give us reasonable time to remediate before any public disclosure, and avoid privacy violations, data destruction, or service degradation while investigating.

Goldroad is a continuously-deployed web application; the hosted service always runs the latest published release. Security fixes are applied to the current released version — there are no long-term maintenance branches for older versions. If you run a self-hosted instance, track the latest release (see SELF_HOSTING.md).

Secrets never live in the repository. They are stored in Cloudflare Worker secret stores and, for local development, in .dev.vars (gitignored). The .env.example and .dev.vars.example files document key names only. If you believe a secret has been exposed, treat it as compromised: rotate it first (removing it from history does not invalidate a leaked key), then report per the process above.