Security
Found a vulnerability? Thank you — here is exactly what to do (and what not to).
Reporting a vulnerability
Please do not open a public GitHub issue for security problems. Instead, use GitHub's private vulnerability reporting:
- Go to the report form (repository → Security tab → Report a vulnerability)
- Include reproduction steps and impact assessment if you can
You can expect acknowledgement within 72 hours, a status update within 7 days, and credit in the release notes once a fix ships (unless you prefer to stay anonymous).
How LinkYaar protects data
- Row Level Security— every database table enforces access at the Postgres level; even a compromised client cannot read another user's data
- Moderation-by-default — visitor-submitted content (reviews) is invisible until the owner approves it, enforced in the database, not just the UI
- Minimal collection — no visitor cookies, no IP storage, country-level analytics only
- Open source — the entire codebase is publicly auditable, and CodeQL scanning plus Dependabot run on every change
Formal policy: SECURITY.md