The following versions of TabTwin are currently receiving security updates:

Please do NOT report security vulnerabilities through public GitHub Issues. Public disclosure of a vulnerability before a fix is available puts all users at risk.

GitHub Private Vulnerability Reporting (the only supported private channel):

1. Go to the Security tab of this repository
2. Click "Report a vulnerability"
3. Fill in the private advisory form — your report will be visible only to the maintainer

Please provide as much of the following as possible to help us understand and reproduce the issue:

• Type of vulnerability (e.g., XSS, CSRF, RCE, information disclosure, authentication bypass)
• Affected component (e.g., server/, extension/, webapp/, WebRTC signaling)
• Location — file path, line number, or URL
• Step-by-step reproduction instructions
• Proof of concept or exploit code (if available)
• Potential impact — what an attacker could achieve
• Suggested fix (optional, but very welcome!)

Once you report a vulnerability, here is what to expect:

The following are in scope for vulnerability reports:

• server/ — Node.js WebSocket signaling server (session management, authentication, data exposure)
• extension/ — Chrome Extension (content scripts, background service worker, permissions abuse)
• webapp/ — React web application (XSS, CSRF, broken authentication)
• WebRTC — Peer connection security, unauthorized session access
• API endpoints — Injection, unauthorized access, data leakage

The following are out of scope:

• Vulnerabilities in third-party dependencies (report these directly to the dependency maintainer and also to us if it affects TabTwin)
• Social engineering attacks
• Physical attacks
• Denial of Service (DoS) attacks against our public infrastructure
• Reports from automated scanners without proof of exploitability

If you are contributing code to TabTwin, please follow these guidelines:

• Never commit secrets — API keys, credentials, or tokens must not appear in code
• Validate all inputs — Both client-side and server-side
• Use parameterized queries — Prevent injection attacks
• Sanitize WebSocket messages — Validate structure and content of every message
• Review Chrome Extension permissions — Request only the minimum permissions required in manifest.json
• Keep dependencies updated — Use npm audit regularly; Dependabot PRs are reviewed promptly

We are grateful to the security researchers who responsibly disclose vulnerabilities. Confirmed reporters will be credited in the fix's release notes (unless they prefer to remain anonymous).

This security policy was last updated: August 2026