Security fixes are applied to the latest code on the default branch of this repository (the live demo deployment).

Please do not open a public GitHub issue for security vulnerabilities.

Report privately by email:

• Email: contact@arnobmahmud.com
• Subject (suggested): Security: EmpowerHub / employee-management

Include as much detail as you can:

• Description of the issue and impact
• Steps to reproduce
• Affected URL, API action, or file path (if known)
• Whether you have a suggested fix

You should receive an acknowledgement within a few business days. Please allow reasonable time for investigation and remediation before any public disclosure.

This project is a portfolio and learning demo. It uses a seeded demo admin account for sign-in. Treat demo credentials and any sample data as non-production. Do not store real personal data or production secrets in a public fork without rotating keys and hardening auth.

The tracked demo dataset (prisma/seed-data.ts) must use synthetic names, emails and phones only, and never seeds employee passwords. db:reset:demo / db:reseed:local require ALLOW_DB_WIPE=1, refuse a non-localhost DATABASE_URL unless EH_ALLOW_REMOTE_WIPE=1 is also set, print only the target host and database (never credentials), revoke all sessions and keep a single bcrypt-hashed admin login. The hosted demo database is demo-only; never point these scripts at a database holding real data.

Optional integrations (AI keys, CMS tokens, email SMTP/Resend, Sentry auth tokens) must stay server-side (see .env.example). Never commit real .env files or put secrets under NG_APP_* prefixes.

• Portfolio: https://www.arnobmahmud.com
• Security / private reports: contact@arnobmahmud.com