# Security policy

OpenVibe is run in the open, and we want to hear about security problems before anyone else does.

## Reporting a vulnerability

Email **contact@openvibe.network** with "security" in the subject. Please include what you found, where (URL,
repository, file), how to reproduce it, and what an attacker could do with it. Do not open a public GitHub issue for
a vulnerability, and do not test against other people's accounts, data or streams.

We reply within 7 days, keep you updated while we fix it, and credit you when the fix ships if you would like.

## Scope

Every OpenVibe service and site (openvibe.live, openvibe.network, openvibe.tools, openvibe.media, openvibe.community,
openvibe.games and the other openvibe.* domains) and every repository under github.com/OpenVibers. Machine-readable
contact details are at `/.well-known/security.txt` on each site.

For OpenVibe.Report specifically: the service reads Network, Live and Billing over loopback, keeps its own
analytics tables (counts and public channel facts only; no money payloads), and has no accounts. The interesting
surface is the path parameters it forwards (validated before a request), the HTML it renders (every source text is
escaped by `server/views/index.js`), the `/internal/` routes (loopback-only; `POST /internal/events` verifies the
Events v2 HMAC) and the origins and service token it is configured with. A Billing or Events secret is never logged.

## Supported versions

Only the current `main` branch, which is what runs in production, receives fixes.