We take security seriously at LibreDiary. If you discover a security vulnerability, please report it responsibly.

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please send an email to security@akaalcreatives.com with:

1. Description - A clear description of the vulnerability
2. Impact - The potential impact of the vulnerability
3. Steps to Reproduce - Detailed steps to reproduce the issue
4. Affected Versions - Which versions are affected
5. Suggested Fix - If you have a suggested fix, please include it

• Acknowledgment - We will acknowledge receipt of your report within 48 hours
• Assessment - We will assess the vulnerability and determine its severity
• Updates - We will keep you informed of our progress
• Resolution - We aim to resolve critical vulnerabilities promptly
• Credit - With your permission, we will credit you in our security advisories

The following are in scope for security reports:

• LibreDiary web application
• LibreDiary server/API
• Authentication and authorization issues
• Data exposure or leakage
• Injection vulnerabilities
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)

• Issues in third-party dependencies (please report these to the respective maintainers)
• Social engineering attacks
• Physical attacks
• Issues requiring unlikely user interaction

When self-hosting LibreDiary:

1. Keep your installation up to date
2. Use HTTPS in production
3. Configure proper firewall rules
4. Regularly backup your data
5. Use strong, unique passwords
6. Review and restrict API access

Security updates will be released as patch versions. We recommend enabling automatic updates or regularly checking for new releases.

Thank you for helping keep LibreDiary and its users safe!