Please report security vulnerabilities privately through GitHub, using Report a vulnerability under the repository's Security tab.
Do not open a public issue or pull request for a security vulnerability.
A useful report includes:
- The affected component (
web,api, orqueue) and, if possible, the relevant file or endpoint - Steps to reproduce, or a proof of concept
- What an attacker could accomplish with it
You can expect an initial reply within a week. If the report is valid, you'll get updates as a fix is developed, and you're welcome to be credited in the advisory once it's published.
In scope:
- The Overplayed web client
api-overplayed.gaelangel.com(API at/api, queue service at/queue)- Source code in this repository, including CI/CD workflows and deployment configuration
Out of scope:
- Vulnerabilities in third-party services Overplayed depends on (report those to the service directly)
- Denial of service and volumetric testing
- Reports from automated scanners with no demonstrated impact
Please limit testing to accounts and data you own, and avoid actions that degrade the service for other users.