• Supported Versions
• Reporting a Vulnerability
• Response Timeline
• Disclosure Policy
• Security Best Practices
• Acknowledgments

If you discover a security vulnerability in Taskboard, please report it responsibly.

Do not open a public issue. Instead, send a detailed report to the project maintainers.

• A clear description of the vulnerability
• Steps to reproduce the issue
• Affected versions
• Potential impact
• Any suggested fixes (if available)

• Acknowledgment: Within 48 hours of receipt
• Status Update: Within 5 business days
• Resolution: We aim to resolve critical issues within 30 days

We follow a coordinated disclosure process:

1. The vulnerability is reported privately
2. A fix is developed and tested
3. A security release is published
4. Public disclosure follows after users have had time to update

Taskboard implements several security measures:

• Session Management: HMAC-SHA256 signed httpOnly cookies with 7-day expiry
• Password Hashing: bcrypt with salt rounds
• Rate Limiting: Per-IP rate limiting on authentication endpoints
• Input Validation: Zod schemas on all API routes
• XSS Protection: DOMPurify sanitization on user-generated content
• Security Headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

We appreciate the security research community's efforts in making Taskboard more secure. Responsible disclosures will be acknowledged (with permission) in our release notes.