We issue security updates for the latest stable release of Foreman Kanban.

We take the security of Foreman Kanban seriously. If you believe you have found a security vulnerability in this project, please report it to us responsibly.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report security issues by:

1. Opening a Private Security Advisory on GitHub, or
2. Contacting the lead maintainer directly via email at security@foreman.dev.

To help us triage and resolve the issue quickly, please include:

• A description of the vulnerability and its potential impact.
• Step-by-step instructions to reproduce the issue (including proof-of-concept code or HTTP requests if applicable).
• Affected components (Frontend, Backend REST API, Database, or Infrastructure).

• Initial Acknowledgment: Within 48 hours.
• Triage & Assessment: Within 5 business days.
• Fix & Patch Release: Target within 14 business days depending on severity.

For details on the project's security architecture, Firebase JWT verification, and server-side RBAC guards, please refer to docs/security.md.