Please report suspected security vulnerabilities privately. Do not open a public issue or disclose the vulnerability publicly until we have coordinated a fix.
The preferred way to report is GitHub's private vulnerability reporting: on the affected repository, go to the Security tab and click Report a vulnerability (or open https://github.com/getAlby/<repository>/security/advisories/new). Alternatively, you can email security@getalby.com.
Please include the affected version or component, the potential impact, and clear steps to reproduce the issue. We will acknowledge your report and keep you informed as we investigate and address it.