At SoraLabs, we take the security of Sora UI, our component registry, CLI tools, and ecosystem services seriously. If you believe you have found a security vulnerability, we appreciate your help in disclosing it to us responsibly.

Please do not open a public GitHub issue, pull request, or discussion for security vulnerabilities. Publicly disclosing a vulnerability can put the community and projects using Sora UI at risk.

You can report vulnerabilities through either of the following private channels:

1. GitHub Security Advisories (Recommended):
   Submit a confidential report directly via GitHub Security Advisories.
2. Email:
   Send details directly to security@soralabs.studio.

To help us assess and resolve the issue quickly, please include:

• A clear summary of the vulnerability.
• Affected package, registry component, CLI tool, or web service (e.g., packages/auth-ui, packages/www-cli, apps/www, or a specific component in registry/).
• Step-by-step instructions or a minimal Proof of Concept (PoC) to reproduce the issue.
• Potential impact and exploitation scenario.
• Any suggested fixes or mitigations (optional).

• Acknowledgement: The SoraLabs team will acknowledge receipt of your report within 48–72 hours.
• Assessment & Triage: We will verify the vulnerability, determine its severity, and keep you informed of our progress.
• Fix & Release: If confirmed, we will develop and release a security patch as soon as possible.
• Coordinated Disclosure: Once a fix is released, we will publish a security advisory. We will gladly credit you for your responsible disclosure (unless you prefer to remain anonymous).