If you discover a security vulnerability in the X Linux Website (Next.js exploits, SSR vulnerabilities) or the System Packages (repository database integrity, x-release hooks), please report it responsibly via email to:

Email: x@xscriptor.com

Do not open public GitHub issues for security vulnerabilities. Private disclosure allows us to fix the issue before it can be exploited.

When reporting a security issue, please provide:

1. Description — A clear explanation of the vulnerability.
2. Type — The category of the issue (e.g., XSS, Repository Injection, Sensitive Data Exposure).
3. Steps to Reproduce — Detailed steps or a Proof of Concept (PoC) to trigger the vulnerability.
4. Impact — How severe is the issue? Could it compromise the website or the users' systems?
5. Affected Component — Which part is affected? (e.g., the Next.js frontend or the build-repo.sh logic).

• Confidentiality — Do not disclose the vulnerability publicly until a fix is released.
• Patience — Please give the maintainers reasonable time to address the issue before public disclosure.
• Response Time — We aim to acknowledge receipt within 7 days.

For developers and maintainers of the X Repo:

• Web Security — Always keep Next.js dependencies updated and sanitize any user-provided data in the app/ routes.
• Package Integrity — Ensure XBUILD and PKGBUILD files do not download binaries from untrusted third-party sources.
• Repository Signing — Maintain the security of the GPG keys used to sign the [x] repository database.
• Environment Variables — Never hardcode API keys or private tokens in the website source code; use .env files (git-ignored).