Please do not open a public issue for security vulnerabilities.
Report privately to info@solidea.tech (or use GitHub's private vulnerability reporting). Include a description, reproduction steps, and the impact you observed. We aim to acknowledge within a few business days and will keep you updated on the fix.
This repository is the Solarch application stack (apps/web, apps/server) and the
self-host bundle. The hosted service at app.solarch.dev is also
in scope. Please report responsibly and give us reasonable time to remediate before any
public disclosure.
Never commit real credentials. All secrets are provided via environment variables — see
.env.example. The codegen pipeline applies best-effort redaction: fields flagged
IsSecret are blanked in generated output (values in free-text fields are not detected).
If you find a bypass, please report it via the process above.