Security fixes are considered for the main branch and the latest published state of this repository.
| Component | Scope |
|---|---|
backend-dotnet/ |
ASP.NET Core API, authentication, endpoints, HTTP integrations |
frontend-angular/ |
Angular SPA (client-side) |
frontend-react/ |
Next.js app (client + server routes) |
| Dependencies | NuGet / npm — updates via PR or advisory |
Older tags, forks, or deployments may not receive backported fixes. This project is a starter template; production deployments are the responsibility of those who operate them (secrets, HTTPS, WAF, etc.).
Do not open a public issue for security flaws.
Use one of these options:
- GitHub Security Advisories (recommended — private report)
- Contact the maintainer through their GitHub profile using a private channel
- Clear description of the issue and impact
- Steps to reproduce (PoC if possible)
- Affected component (
backend-dotnet,frontend-angular,frontend-react) - Version/commit or tag
- Mitigation suggestion (optional)
- Real credentials, JWT tokens, connection strings, or database dumps
- Third-party personal data
Reports are reviewed as capacity allows. There is no formal SLA — CleanStack is maintained as an open source project alongside other work.
- Misconfiguration in user deployments (e.g., exposed
.env, permissive CORS in production) - Vulnerabilities already fixed in newer upstream dependency versions
- Issues in forks not merged into this repository
- Never commit secrets; use environment variables and secret managers
- Enable HTTPS in production
- Keep dependencies up to date (
dotnet list package --outdated,npm audit) - Implement real authentication/authorization before exposing sensitive data (current MVP uses stubs in parts of the frontend)
We appreciate responsible reports that help keep the foundation safer for everyone.