Only the latest major version gets security fixes. See docs/releases.md.

Report vulnerabilities privately through GitHub's private vulnerability reporting. Don't open a public issue or pull request.

Include what is affected, how to reproduce it, and the impact you expect. Maintainers are volunteers, so replies can take a few days. Once a fix is released, the advisory is published with credit to you, unless you'd rather not be named.

Hoverboard is a template, and each site runs in its organizer's own Firebase project. A problem with a single site, such as its content, its Firebase settings or a change made in a fork, belongs to that site's organizers, not to this repository.