Security policy
We want to hear about any vulnerability in Maktaba: the server, the apps, the cloud services and this site.
How to report
Email security@maktaba.dev with what you found, how to reproduce it and what it lets an attacker do. Please do not open a public GitHub issue for a vulnerability.
What happens next
We confirm your report, work on a fix, and tell you when it ships. We publish an advisory with the release that fixes it, and credit you if you want to be credited.
Good faith
Test only against your own Maktaba installation. Do not access other people's data, do not degrade a service for others, and give us reasonable time to fix a problem before you share it.
Rules for plugins and contributors
Plugins run sandboxed with no internet and only the access they are granted. Code sent to Maktaba carries no secrets and checks every role on the server.