Booth stores owner accounts, customer contact data and payment receipts, so security reports are taken seriously and handled first.

Please do not open a public issue, pull request or discussion for security problems.

Report privately through GitHub: go to the repository's Security tab → Report a vulnerability (direct link). Include:

• What is affected (endpoint, page, package) and the impact.
• Steps to reproduce or a proof of concept.
• Any suggested fix, if you have one.

Reports in English or Spanish are welcome.

• Acknowledgement within 3 business days.
• An initial assessment within 7 days, with severity and next steps.
• A fix in a private advisory, then a release and a published advisory crediting you (unless you prefer to stay anonymous).

In scope:

• Tenant isolation: one store reading or changing another store's data.
• Authentication and sessions (tokens, refresh rotation, cookies).
• Order integrity: prices, totals, stock reservation, order tracking tokens.
• Access to private receipts or customer personal data.
• The demo read-only guard.
• Injection, XSS, CSRF, SSRF or file upload issues.

Out of scope:

• Denial of service or load testing against hosted instances.
• Social engineering, spam or physical attacks.
• Reports from automated scanners without a demonstrated impact.
• Issues in third-party services (Cloudinary, Neon, Render, Vercel, WhatsApp) not caused by Booth.

Good-faith research that follows this policy is welcome: use your own accounts and test stores, never access or keep other people's data, and give us reasonable time to fix the issue before disclosing it.