Please report security issues privately — do not open a public issue.

Use GitHub's private vulnerability reporting: the Security tab → Report a vulnerability. This opens a private advisory visible only to the maintainers.

This project is maintained on a best-effort basis. We aim to acknowledge reports within a few business days, but make no formal response-time guarantee. Please give us a reasonable window to ship a fix before any public disclosure.

This is a self-hosted application: you operate your own instance. There is no hosted service to report against. Reports are most useful when they concern the code in this repository rather than a particular deployment's configuration.

Campers' HTML/CSS/JS runs in the live preview and in shared/printed views. This is intentional and sandboxed:

• Preview and share iframes run with sandbox="allow-scripts" and no allow-same-origin, so user code cannot read the parent origin's cookies or storage. Do not add allow-same-origin.
• The authoring Preview additionally gets allow-modals (so a camper's own alert/confirm/prompt works). ShareView deliberately omits it, since a shared pen is another user's code on our origin and modal dialogs could be used to phish the viewer.
• Session tokens live in the parent app's localStorage only; the sandboxed iframe cannot reach them.

Reports that demonstrate a way around these boundaries (origin/cookie/storage access, token theft, stored XSS escaping the sandbox) are in scope and valued.

• Keep OIDC_CLIENT_SECRET and DATABASE_URL out of source control; inject them from your platform's secret manager.
• Serve over HTTPS in production.
• Set ADMIN_EMAILS deliberately — it grants the instructor role.
• Leave OIDC_ALLOW_UNVERIFIED_EMAIL=false unless your IdP is fully trusted; instructor role is keyed on the email claim.