We provide security fixes for the latest release on the main branch of each repository.
| Repository | Supported |
|---|---|
| iu-alumni-backend | ✅ latest main |
| iu-alumni-frontend | ✅ latest main |
| iu-alumni-mobile | ✅ latest main |
| iu-alumni-infra | ✅ latest main |
| iu-alumni-bot | ✅ latest main |
Please do not open a public GitHub issue for security vulnerabilities.
Report security issues privately via one of these channels:
- GitHub Private Advisory — use the Security tab of the affected repository → Report a vulnerability
- Telegram (direct message) — contact a maintainer via t.me/+8hrAOuObPXQzZGRi
- A clear description of the vulnerability
- Steps to reproduce or a proof-of-concept
- Potential impact and affected versions
- Any suggested mitigations (optional)
| Step | Target |
|---|---|
| Acknowledgement | Within 3 business days |
| Initial triage | Within 7 business days |
| Fix or mitigation | Depends on severity |
| Public disclosure | After fix is released |
We follow responsible disclosure — we will coordinate with you on the disclosure timeline.
The following are in scope:
- Authentication and authorization bypasses
- Data exposure or injection vulnerabilities (SQLi, XSS, SSRF, etc.)
- Insecure direct object references
- Infrastructure misconfiguration leading to data exposure
The following are out of scope:
- Denial-of-service attacks
- Social engineering
- Issues in third-party dependencies (report upstream)
- Theoretical vulnerabilities without proof of exploitability