WorkFlow is self-hosted software — each install is a separate, independent deployment, so there's no shared production environment to protect. Still, if you find a vulnerability that could affect other self-hosted installs (e.g. an auth bypass, SQL injection, XSS, or a way to read another workspace's data), please report it privately rather than opening a public issue.

Open a private security advisory via GitHub's "Report a vulnerability" button on the Security tab of this repository. Include:

• What the vulnerability is and what it allows an attacker to do
• Steps to reproduce it
• Which version/commit you tested against

You'll get an acknowledgment, and a fix or mitigation guidance once confirmed. There's no bug bounty program — this is a community project.

There's currently one active line of development (main). Security fixes land there; there's no long-term-support branch to backport to.