If you discover a security vulnerability in AI App Idea Generator, please report it responsibly. Do not open a public GitHub issue for security vulnerabilities.
Email us at hello@enterprisedna.co with:
- A description of the vulnerability
- Steps to reproduce the issue
- The potential impact
- Any suggested fixes (optional)
- Acknowledgment within 48 hours of your report
- Status update within 7 days with our assessment
- Resolution timeline communicated once we've triaged the issue
- Credit in the release notes (unless you prefer to remain anonymous)
The following are in scope:
- Authentication and authorization bypasses
- Token or credential exposure
- SQL injection or other injection attacks
- Cross-site scripting (XSS) or cross-site request forgery (CSRF)
- Sensitive data exposure in API responses
- Insecure default configurations
- Prompt injection leading to privilege escalation or data leakage
- Vulnerabilities in third-party dependencies (report these upstream)
- Issues requiring physical access to a user's device
- Social engineering attacks
- Denial of service attacks
- Never commit
.envor any file containing secrets to version control - Store the OpenAI API key in Supabase secrets, not in
.envor the frontend - Enable Row Level Security (RLS) on every user-facing Supabase table
- Keep dependencies updated with
npm auditandnpm update - Use HTTPS in production (required for Supabase Auth)
- Configure Supabase Auth redirect URLs to your actual domain, not wildcards
- Rotate the Supabase anon key if you believe it's been exposed
| Version | Supported |
|---|---|
| Latest | Yes |
| Older | No |
We only provide security fixes for the latest release.