Please do not open a public issue for a security problem.

Report it privately through GitHub's advisory form, or email security@zite.com. We will acknowledge within three working days and keep you updated until it is resolved. If you would like credit in the advisory, say so and we will include you.

This repository is a template. It is installed into a workspace that you run, so a report against it is about the application code here: endpoint authorization, data exposure between people or organizations, injection through user-supplied content, that kind of thing.

Vulnerabilities in the Zite platform itself (auth, the endpoint runtime, hosting) go to security@zite.com too, but say which you mean.

• The demo data is public sample content: a fictional product team, its issues and sprints.
• The app is internal, so every signed-in organization member can see every issue. There is no per-project access control by design.

This is a template rather than a released library. Fixes land on main and you pick them up by merging. There are no maintained release branches.