Security fixes target the latest published ProjectForge release. Upgrade before reporting a problem that may already be fixed.

Use the repository's private vulnerability report. Do not open a public issue containing credentials, sensitive generated instructions, convention content, provider account details, or an exploit that would put users at risk.

Include the ProjectForge version, operating system, provider name and version, approval mode, minimal reproduction steps, expected boundary, observed impact, and redacted evidence. Never send real tokens or .env contents.

For non-security bugs, use GitHub Issues.