Please do not report security vulnerabilities in public issues or pull requests. Use GitHub's Report a vulnerability action on the Joey repository's Security page so the report is visible only to the maintainers. Include the affected version or commit, impact, and steps to reproduce. Do not include real customer data or credentials.

The maintainers will acknowledge reports through GitHub and coordinate a fix and disclosure with the reporter. No response-time guarantee is currently published.

Security fixes are developed against the latest main branch. Self-hosters should keep Joey and its database migrations current.