StreamGive handles donation data and includes admin endpoints authenticated by cryptographic signatures. We appreciate responsible reports that help us keep donors, NGOs, and the service safe.

Please report suspected security vulnerabilities privately by emailing security@streamgive.org. Do not open a public GitHub issue or disclose the problem publicly before we have had a reasonable opportunity to investigate and release a fix.

Include, where possible:

• a clear description of the vulnerability and its potential impact;
• the affected endpoint, component, commit, or configuration;
• reliable reproduction steps or a proof of concept; and
• any relevant logs, screenshots, or suggested mitigation.

Please avoid accessing, modifying, or deleting data that does not belong to you. Stop testing if you encounter another person's private data and tell us what happened in your report.

We will acknowledge receipt within five business days and keep the report confidential while it is being investigated. We will work with the reporter to understand the issue, determine its severity, and coordinate a fix and any public disclosure. We may request additional information or ask for a reasonable amount of time to remediate before disclosure.

Please do not include secrets, private keys, or unnecessary personal data in a report. Reports made in good faith and in accordance with this policy will not result in legal action by StreamGive for the testing activity itself.

This policy covers this repository and the StreamGive backend services it builds. Denial-of-service testing, social engineering, spam, and vulnerabilities in third-party services are out of scope; please report those to the relevant provider.