Please report security issues privately, not in a public issue.

Use GitHub Security Advisories to open a private report. That keeps the details between you and the maintainer until a fix is out.

Include what a bug report needs: the request or command, the full output, the Tifa and Go versions, and the smallest app or route that shows it. We will acknowledge the report, work on a fix, and credit you unless you prefer otherwise.

Fixes land in the latest release (the newest v0.0.x tag of github.com/liustack/tifa). Upgrade to it before reporting.

Tifa renders React pages inside the server process, keeps sessions and remembers rendered pages. How the session cookie works is in docs/sessions.md, the security headers and Content-Security-Policy are in docs/config.md, and what the render memo keys on is in docs/app.md. Read them before reporting behavior that may be working as intended.