The Divmora security team takes all vulnerabilities seriously. We appreciate your efforts to responsibly disclose findings.

We provide security updates for the following versions of AuthPin:

If you discover a security vulnerability, do not open a public issue. Instead, follow one of the private disclosure channels below:

1. GitHub Private Vulnerability Reporting (Recommended): Navigate to the Security Advisories tab on GitHub and click "Report a vulnerability".

2. Email Disclosure: Send an encrypted report to security@divmora.com with:

   • Description of the vulnerability and affected endpoints.
   • Proof of Concept (PoC) or reproduction steps.
   • Impact assessment.

• Initial Acknowledgment: Within 48 hours.
• Assessment & Triage: Within 5 business days.
• Coordinated Disclosure: Fixes will be coordinated and released with credit given to the reporter.