We release patches for security vulnerabilities:

Please do not report security vulnerabilities through public GitHub issues.

We take the security of Laravel Gale seriously. If you discover a security vulnerability:

Please do not create a public GitHub issue for the vulnerability.

Send a detailed report to: dancycodes@gmail.com

Include:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Suggested fix (if you have one)

You should receive an acknowledgment within 48 hours. We will:

1. Confirm receipt of your vulnerability report
2. Assign a severity level
3. Develop and test a fix
4. Prepare a security advisory
5. Release a patch

When using Laravel Gale:

Always validate data on the server:

public function update(Request $request)
{
    $validated = $request->validate([
        'email' => 'required|email|unique:users',
        'role' => 'required|in:user,admin'
    ]);

    // Use validated data...
}

Always verify permissions before performing sensitive operations:

public function delete($id)
{
    $post = Post::findOrFail($id);

    if (!auth()->user()->can('delete', $post)) {
        abort(403);
    }

    $post->delete();

    return gale()->state(['deleted' => true]);
}

Always use CSRF-protected actions for mutating operations:

<!-- Correct: Uses $postx with automatic CSRF -->
<button @click="$postx('/delete')">Delete</button>

<!-- Wrong: Uses $post without CSRF -->
<button @click="$post('/delete')">Delete</button>

Gale uses Blade's automatic escaping, but be careful with raw HTML:

// Safe: Blade escaping
return gale()->view('partial', ['username' => $username]);

// Better: Use views for dynamic content
return gale()->view('partial', compact('username'));

Implement rate limiting for Gale endpoints:

Route::post('/search', [SearchController::class, 'search'])
    ->middleware('throttle:60,1');

Security advisories will be published in this repository's Security Advisories.

For security concerns: dancycodes@gmail.com

Thank you for helping keep Laravel Gale and its users safe!