The Planneer team takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose your findings.
Please do NOT report security vulnerabilities through public GitHub issues.
Instead, please report them by email to: security@planneer.appß
Include the following information (as much as you can provide):
- Type of vulnerability
- Full paths of source file(s) related to the vulnerability
- Location of the affected source code (tag/branch/commit or direct URL)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the vulnerability and how an attacker might exploit it
- Acknowledgment: We will acknowledge your email within 48 hours
- Updates: We will keep you informed about our progress
- Timeline: We aim to address critical vulnerabilities within 7 days
- Credit: We will credit you in our security advisories (unless you prefer to remain anonymous)
We provide security updates for the following versions:
| Version | Supported |
|---|---|
| main | ✅ |
| < 1.0 | ❌ |
When deploying Planneer in production:
- HTTPS Only: Always use HTTPS in production
- Environment Variables: Never commit secrets to git
- Admin UI: Restrict PocketBase admin UI access (set
PLANNEER_ALLOW_ADMIN_UI=false) - Updates: Keep all dependencies up to date
- Backups: Implement regular automated backups
- Rate Limiting: Ensure rate limiting is enabled
- Demo User: Demo user only exists in development mode (
PB_DEV=true)
- Offline Storage: Data stored in browser IndexedDB is not encrypted at rest
- Demo User: In development mode, a demo user exists with a known password (see
.env.example) - Admin UI: The PocketBase admin UI at
/_/should be restricted in production
Planneer has undergone internal security audits.
When we receive a security bug report, we will:
- Confirm the problem and determine affected versions
- Audit code to find any similar problems
- Prepare fixes for all supported versions
- Release new versions as soon as possible
- Publish a security advisory
If you have suggestions on how this process could be improved, please submit a pull request.