Security fixes go into the latest release of each Saucebase package: saucebase/core, the starter, the installer, and the modules. Update to the latest version before reporting.

Please do not open a public issue, pull request or discussion for a security problem.

Email hello@saucebase.dev with:

• the affected package and version;
• what an attacker can do, and the steps to reproduce it;
• any proof of concept or logs that help.

You will get a reply within 3 working days. We will keep you updated while we work on a fix, agree on a disclosure date with you, and credit you in the release notes unless you prefer not.