EchoHub/SECURITY.md

Security Policy

Reporting a vulnerability

If you believe you’ve found a security vulnerability in EchoHub (for example: auth bypass, token leakage, file upload validation bypass, RCE, etc.), please do not open a public GitHub issue.

Preferred: use GitHub’s private vulnerability reporting ("Report a vulnerability"):

• https://github.com/HueByte/EchoHub/security/advisories/new

If that link is unavailable for your account, contact the maintainer via GitHub:

• https://github.com/HueByte

What to include

• A clear description of the issue and potential impact
• Reproduction steps or a proof-of-concept
• Affected versions / commit SHA
• Any relevant logs (with secrets removed)

Disclosure

I’ll acknowledge receipt, investigate, and work on a fix. Please avoid publicly disclosing details until a fix is available.