Do not open a public issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting:

1. Go to the repository
2. Click "Security" tab
3. Click "Report a vulnerability"
4. Fill in the details

Or email: security@barazo.forum

We will respond within 72 hours with next steps.

barazo-web is the Next.js frontend -- it renders user-generated content, handles client-side OAuth flows, and communicates with the API. The following areas are in scope for security reports:

• Stored XSS -- user-generated content (topics, replies, profiles) rendering unsanitized HTML
• Reflected XSS -- URL parameters or search queries reflected in page output without escaping
• DOM-based XSS -- client-side JavaScript constructing DOM from untrusted data
• Markdown rendering -- malicious markdown/HTML bypassing the sanitization pipeline

• State-changing actions -- actions (create topic, react, report, moderate) that can be triggered by external sites
• OAuth state parameter -- CSRF in the AT Protocol OAuth callback flow

• CSP bypass -- techniques to execute scripts or load resources that violate the Content Security Policy
• Inline script injection -- circumventing CSP nonce or hash requirements
• External resource loading -- loading unauthorized third-party scripts or styles

• OAuth token leakage -- access tokens exposed in URLs, logs, or browser history
• Session fixation -- reusing or injecting session identifiers
• Open redirect -- OAuth callback or navigation URLs redirecting to external malicious sites

• Server-side rendering leaks -- SSR exposing API keys, internal URLs, or admin data in HTML source
• Error messages -- stack traces or internal paths exposed to users
• SEO metadata injection -- manipulating JSON-LD, OpenGraph, or sitemap output with user-controlled data

• Local storage/cookie exposure -- sensitive data stored insecurely in the browser
• Clickjacking -- missing or bypassable frame-busting (X-Frame-Options / frame-ancestors)
• Prototype pollution -- client-side prototype pollution via URL parameters or user input

• All user-generated content sanitized before rendering
• Content Security Policy headers configured via Next.js
• HTTPS-only (enforced by Caddy reverse proxy with HSTS)
• No inline scripts or eval (CSP-compatible)
• eslint-plugin-jsx-a11y in strict mode (catches some security-adjacent issues)
• No secret values in client-side bundles (NEXT_PUBLIC_ prefix convention)
• Dependencies updated weekly via Dependabot
• CodeQL security scanning on every PR

We follow responsible disclosure:

• 90 days before public disclosure
• Credit given to reporter (if desired)
• CVE assigned when applicable