Please report security issues privately via GitHub Security Advisories for this repo — not a public issue or PR. We aim to respond within 72 hours.
- The local canvas server (
packages/server) and its/api/*routes, including the Host/Origin allowlist - Terraform/OpenTofu state and plan parsing (
packages/core) - The telemetry pipeline: client (
packages/server/src/telemetry.ts) and collector (telemetry-collector/)
Out of scope: vulnerabilities in Terraform/OpenTofu themselves, or in cloud provider APIs stackcanvas reads from.