Because of the Bring-Your-Own-Backend (BYOB) architecture, each user runs their own decentralized instance of Open Source Scout (Supabase + Edge Functions). Security patches are delivered to the main branch and distributed via updates to the setup CLI.

We currently only support security updates for the latest major version.

We take the security of Open Source Scout seriously. Since this project manages personal access tokens and database deployments, any vulnerability affecting auth or data isolation is critical.

If you discover a security vulnerability, please DO NOT open a public issue.

Instead, please report it privately:

1. Go to the Security tab of this repository on GitHub.
2. Click Report a vulnerability to open a private advisory.
3. Provide detailed steps to reproduce the issue.

We will acknowledge receipt of your vulnerability report within 48 hours and strive to send you regular updates about our progress.

Thank you for helping keep Scout safe!