Please do not open a public issue for a security vulnerability.
Instead, use GitHub's private reporting:
- Go to the Security tab of this repo.
- Click "Report a vulnerability".
If that's not available or convenient, email hseghetti@gmail.com with a description of the issue and, if possible, steps to reproduce it. This is a side project maintained by one person — there's no SLA, but reports will be looked at and acknowledged as soon as possible.
Please don't test findings against the live production deployment (coliseo-six.vercel.app) beyond what's needed to confirm the issue — it's a real, low-traffic, non-commercial service, not a sanctioned pentest target.
Before reporting, it may be worth checking the Security section of the
README — it documents the security model in detail (RLS on every table,
Vault-encrypted BYOK keys, locked-down SECURITY DEFINER functions, and the SSRF hardening
around A2A federation's outbound HTTP calls), so you can see what's already a deliberate design
choice versus what might be a genuine gap.
In scope: apps/web, apps/debate-engine, and the Supabase schema in supabase/migrations/.
Out of scope: third-party dependencies (report those upstream), and the hosting providers themselves (Vercel, Fly.io, Supabase) — report platform-level issues to them directly.