Only the latest release of SubHarvest is supported with security updates. If you are running an older version, please upgrade before reporting issues.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, send an email to security@subharvest.dev with the following information:

• A clear description of the vulnerability
• Steps to reproduce the issue
• An assessment of the potential impact (e.g., data exposure, privilege escalation, denial of service)
• Any suggested fixes, if applicable

• Acknowledgment: Within 48 hours of receiving your report.
• Critical fixes: Within 30 days for critical severity vulnerabilities.
• Non-critical fixes: Addressed in the next scheduled release where feasible.

SubHarvest follows a coordinated disclosure process. Vulnerabilities will be disclosed publicly only after a fix has been released. We will credit reporters unless they request otherwise.

When deploying SubHarvest, ensure the following:

• JWT secret: Change the default JWT_SECRET value to a strong, randomly generated string. Never use the example value in production.
• Admin password: Use a strong, unique password for the admin account.
• CORS origin: Set CORS_ORIGIN to your actual production domain. Do not leave it as the default localhost value.
• Reverse proxy and TLS: Run the application behind a reverse proxy (e.g., Nginx, Caddy) with TLS enabled. Do not expose the API or web UI directly over plain HTTP in production.