openRun holds people's runs, GPS routes and intervals.icu access, so security reports are very welcome.
Please report it privately through GitHub: Report a vulnerability (Security → Advisories → Report a vulnerability). Don't open a public issue.
Include what you found, how to reproduce it, and what someone could do with it. You'll get a reply within a week. Once it's fixed, the advisory is published with credit to you, unless you'd rather not be named.
Fixes go into the latest release and main. openRun is pre-1.0, so there are
no older release lines to backport to: upgrade to the latest release (see
Upgrading).
Release images and source archives come with signed build provenance:
gh attestation verify oci://ghcr.io/stretch0/openrun:0.1 -R stretch0/openRun
gh attestation verify openrun-0.1.0.tar.gz -R stretch0/openRunWhoever runs an openRun server can read what's stored on it. See
docs/PRIVACY.md for what's stored and who can see what, and
the README for keeping .env and backups safe.