Kocteau includes auth, Supabase data access, recommendation logic, and user-generated content. Please report security issues privately.
Use GitHub private vulnerability reporting:
https://github.com/francozeta/kocteau/security/advisories/new
If private reporting is unavailable, contact the repository owner before opening a public issue.
- Open public issues for exploitable auth, data, or permission bugs
- Exfiltrate, modify, or delete data
- Test against accounts or data you do not control
- Publish proof-of-concept exploit details before a fix is available
- Supabase schema, RLS, RPCs, and storage
- Auth, onboarding, sessions, and proxy behavior
- API routes that write data
- Recommendation and analytics data flows
- Environment and Sentry configuration
Never post service role keys, Supabase secret keys, database passwords, pooler URLs, access tokens, SMTP credentials, or production .env.local values in issues, PRs, chat, or docs.
The frontend may use public Supabase keys through NEXT_PUBLIC_* variables. Privileged keys belong only in controlled deployment, GitHub, Supabase, or maintainer secret stores.