Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report them privately using either:

1. GitHub private vulnerability reporting
2. Email security@appwrite.io

Include as much of the following as you can:

• A description of the issue and why it is security-sensitive
• Affected versions, tags, or commit SHAs
• Steps to reproduce, or a proof of concept
• Impact (confidentiality, integrity, availability, or privilege)
• Any suggested mitigations or fixes

We will acknowledge the report and follow up with next steps. If the issue is confirmed, we will work on a fix and coordinate public disclosure with you. Please give us a reasonable time to investigate and ship a fix before discussing the issue publicly.

Security updates are published for the latest stable self-hosted release of Appwrite. Upgrade to the latest patch of the current minor release whenever possible.

Support phases and longer-term coverage are described in the Appwrite release policy.

This policy covers the Appwrite server in this repository. Report issues in other Appwrite projects (SDKs, Console, Cloud) through that project's security policy when one exists, or to security@appwrite.io.