The AccountGo project team takes the security of our software and users seriously. This document outlines our security policies and procedures for reporting vulnerabilities.

We provide security updates and patches for the following versions:

Self-hosted AccountGo uses email one-time codes and Google sign-in. For additional access protection in self-hosted deployments, we recommend enforcing Google 2-Step Verification for your domain or placing AccountGo behind an identity-aware proxy (such as Cloudflare Access or Tailscale). Hosted AccountGo Cloud offers additional sign-in protection on paid plans.

If you discover a security vulnerability in AccountGo, please report it responsibly rather than opening a public issue on GitHub.

1. Email: Send vulnerability details directly to the project creator at support@accountgo.dev.
2. GitHub Security Advisory: You may also privately report vulnerabilities through GitHub's Private Vulnerability Reporting interface.

To help us triage and resolve the issue quickly, please provide:

• A clear description of the vulnerability.
• Steps to reproduce the issue (including sample payloads, code snippets, or configuration).
• The affected component(s) (e.g., API authentication, tenancy resolution, Web SPA, database).
• Any potential impact or attack vector you have identified.
• Possible mitigations or fixes, if known.

• Acknowledgment: We aim to acknowledge receipt of your report within 48 hours.
• Investigation: We will investigate the report and verify the vulnerability within 5 business days.
• Fix & Remediation: We will prepare a patch and coordinate a release timeline.
• Public Disclosure: Once a patch is released, we will publish a security advisory crediting you for the responsible disclosure (unless you prefer anonymity).

We ask that you maintain confidentiality until we have had an opportunity to address the issue.

Thank you for helping keep AccountGo and our community secure!