Report a Vulnerability
BetterMaddela is an independent, open-source civic-information project. Please disclose suspected vulnerabilities privately, not in a public issue, discussion, pull request, or chat.
Use GitHub private vulnerability reporting . If that form is unavailable, open a public issue asking the maintainer to enable a private reporting channel, and include no vulnerability details in that issue.
What to Include
- The affected page, file, dependency, or deployment;
- Reproducible steps or a minimal proof of concept;
- The likely impact and conditions required to exploit it; and
- Suggested mitigations, without real secrets or personal data.
Response Expectations
No response or remediation deadline is promised. Reports are assessed by impact, reproducibility, and maintainer availability. Coordinated disclosure is agreed with the maintainer before publication.
Security Boundaries
BetterMaddela is a statically deployed public-information site. It intentionally provides no authentication, payments, form submissions, stored records, or client-side administration surface. A future change introducing a server, database, privileged operation, or personal-data collection requires a separate threat review before release.
Security-relevant areas include the repository's source and build configuration, accidental exposure of credentials or private contact details, unsafe rendering or links, third-party integrations, and content that could cause material harm, such as tampered emergency information.
External services, upstream projects, browsers, and hosting providers follow their own security processes; reports affecting this project are still welcome so maintainers can coordinate or mitigate.
Not a Transaction Channel
BetterMaddela must never be used to submit government transactions, credentials, payments, or sensitive personal information. Public factual corrections that do not expose a vulnerability belong in the normal issue tracker route.