The following versions of Echo are currently receiving security updates:

Please do not report security vulnerabilities through public GitHub issues.

If you believe you have found a security vulnerability in Echo, please report it responsibly by emailing:

rishikesh.palande07@gmail.com

To help us triage and respond quickly, please include:

• Type of issue (e.g., XSS, SQL injection, authentication bypass, privilege escalation)
• Affected component (e.g., apps/web, packages/ui)
• Full paths of the source file(s) related to the vulnerability
• Step-by-step instructions to reproduce the issue
• Proof of concept or exploit code (if available)
• Potential impact — what an attacker could achieve
• Your suggested fix (optional but appreciated)

We follow Coordinated Vulnerability Disclosure (CVD):

1. You report the vulnerability privately to us
2. We acknowledge receipt and begin investigation
3. We develop and test a fix
4. We release the fix and publish a security advisory
5. You are credited in the advisory (unless you prefer to remain anonymous)

We ask that you:

• Give us reasonable time to fix the issue before public disclosure
• Avoid accessing or modifying other users' data during testing
• Do not perform denial-of-service attacks
• Do not use social engineering against our team or users

When contributing to Echo:

• Never commit secrets — API keys, passwords, tokens, or private keys
• Validate all user input — sanitize data at every boundary
• Use parameterized queries — prevent SQL injection
• Set proper Content Security Policy headers — prevent XSS
• Avoid dangerouslySetInnerHTML in React components
• Keep dependencies updated — Dependabot PRs should be merged promptly
• Follow the principle of least privilege — request only necessary permissions

This repository uses the following automated security tooling:

We are grateful to security researchers who responsibly disclose vulnerabilities. Contributors will be acknowledged here with their permission.

No vulnerabilities have been reported yet.

Security issues: rishikesh.palande07@gmail.com

For general questions, open a Discussion.