Use GitHub Security Advisories on this repository (Security → Advisories → New draft advisory / Report a vulnerability). Include steps to reproduce, affected versions, and impact.

Do not open a public issue for undisclosed vulnerabilities.

We aim to acknowledge reports within a few business days and to ship a fix or mitigation for confirmed issues in the next patch release when practical.

This policy covers the skateboard template repositories:

• stevederico/skateboard (this boilerplate)
• @stevederico/skateboard-ui

Apps you build from the template are your responsibility to secure and patch.

Only the latest release line of skateboard and skateboard-ui receives security fixes. Upgrade via docs/UPGRADE.md and the migration checklist in AGENTS.md.