Only the latest version main branch and currently deployed version of this project is in scope for security issues. Also, only the production environment is in scope, although it's ok and normal to test the staging environment.

Please don't access, change, or keep data that isn't yours. This app holds information about foster youth. Use the QA site and its seed accounts, or a local copy, for testing.

Preferred: report privately through GitHub. Go to the Security tab and click "Report a vulnerability" (direct link). Only maintainers can see the report, and we can work on the fix together in a private fork.

You can also email casa@rubyforgood.org.

Please do not open a public GitHub issue or pull request about a vulnerability until it has been fixed.

We will reply to all reported issues within a week and update at least every two days.

We currently do not have any bug bounty program but we will be happy to list your name in our contributors list! :)