AstroCast is a personal project. If you find a security vulnerability, please report it privately rather than opening a public issue.
Email adam@adamlange.pl with:
- A description of the vulnerability and its potential impact
- Steps to reproduce (proof-of-concept code/requests welcome)
- The affected component (
webapp/,backend/AstroCast.Worker/,ios/AstroCast/,android/AstroCast/)
This is a best-effort, single-maintainer project — there's no guaranteed response SLA, but I'll acknowledge reports as soon as I can and credit reporters (if desired) once a fix ships.
Please don't test against the live deployment at astrocast.app beyond what's needed
to demonstrate a finding (no automated scanning, load testing, or account
enumeration against real user data). Use a local docker compose up --build
instance for anything more involved.