If you discover a security vulnerability in LUG Manager, please report it responsibly:

1. Do NOT open a public GitHub issue
2. Email the maintainers or use GitHub's private vulnerability reporting
3. Include a description of the vulnerability, steps to reproduce, and potential impact

We will acknowledge your report within 48 hours and work on a fix.

This project implements the following security practices:

• SAST — GitHub CodeQL scans C++ source for injection, buffer overflow, and logic vulnerabilities
• SCA — Trivy scans the Docker image for known CVEs in OS packages and dependencies
• DAST — ZAP baseline scan tests the running application for XSS, CSRF, and injection
• Secret scanning — TruffleHog checks for committed secrets and credentials
• Dockerfile linting — Hadolint validates Dockerfile best practices
• Static analysis — cppcheck for C++ code quality and portability issues
• Test coverage — lcov + Codecov tracks code coverage across 25 test suites

• Authentication: Discord OAuth2 for the web UI (no passwords stored); admin-issued API keys for the JSON API, scoped and hashed at rest — the two are fully independent, neither grants the other's access
• Session management: HttpOnly cookies with 24-hour expiry
• API keys: SHA-256 hashed at rest (raw key shown once at creation, never stored or logged), soft-revocable, scoped to read/write/admin with destructive and privilege-affecting operations requiring admin
• PII protection: Per-field privacy controls with verified member gating
• Audit logging: All actions tracked with actor, entity, diff, timestamp, and IP — including mutations made via the API, attributed to the key's label
• Input validation: Server-side validation on all form and API inputs
• SQL injection prevention: Parameterized queries throughout (no string concatenation in SQL)
• XSS prevention: Mustache templates auto-escape output by default

We only support the latest version on the main branch. Please update to the latest before reporting.