If you think you've found a security problem in Stackapella, in this code or on stackapella.com, please tell us privately: contact@stackapella.com (the address security.txt names), or GitHub's private vulnerability reporting on this repository. Please don't open a public issue.
What helps:
- what you found, and where (the page, the request or the file);
- how to see it happen, step by step;
- what someone could do with it.
- Test only with your own account, or test accounts you made, and never look at other people's recordings, messages or details.
- Don't change or delete anything that isn't yours, and don't slow the service for others (no load testing or denial of service against stackapella.com; run your own install for that).
- Give us a reasonable time to fix it before telling anyone else.
- An answer within 3 working days, and news until it's fixed.
- No action against anyone who reports in good faith and follows the above.
- With your OK, thanks by name once it's fixed. There's no bug bounty.
- The code in this repository, and the apps built from it.
- The service at stackapella.com and its subdomains.
Out of scope: a self-hosted install run by someone else (tell its operator), reports from automated scanners without a way to reproduce them, missing best-practice headers with no demonstrated effect, and social engineering of our team or users.
The longer version is the security page. For how to disclose responsibly in general, see OWASP's vulnerability disclosure cheat sheet.