Please do not report security issues in public issues or pull requests.

Report them privately through GitHub Security Advisories: https://github.com/shipwords-dev/shipwords/security/advisories/new

Include what is affected (package or file), how to reproduce it, and the impact you expect. Issues in money paths (credits, billing, webhooks, refunds), authentication and guest quota are treated as highest priority.

Only the latest code on main is supported. Sites built from shipwords are operated by their owners; report issues with a specific site to that site's contact email.