MingleHub runs live game sessions on patron phones in venues and stores venue owner accounts and billing records, so security reports are welcome and taken seriously.

Please report privately first. Do not open a public issue containing an exploit, a working payload, or steps that would let someone else reproduce an attack against a live venue.

Use this repository's Security tab and choose "Report a vulnerability". That opens a private advisory only the maintainers can read, and it is the only channel that should carry technical detail.

If you cannot reach that form, open a normal issue titled "Security contact request" with no technical detail at all, and a maintainer will arrange a private channel.

Please include, once you are on a private channel:

• what the issue is and which component it affects
• the steps to reproduce it
• what an attacker gains
• anything you already tried that did not work

You can expect an initial response within a few days. This is a small project without a formal SLA or a bug bounty.

In scope: this repository's backend (api/), frontend (frontend/), migrations and scripts (scripts/), and the deployed application.

Particularly interesting:

• cross-venue data access (one venue reading or writing another's data)
• anything letting an unauthenticated patron phone reach owner or admin routes
• billing correctness, especially anything that changes what a venue is charged
• NFC tag replay or forgery

Out of scope: findings that require a compromised device or physical access to an unlocked phone already in a session, denial of service through raw request volume, missing hardening headers with no demonstrated impact, and reports generated by an automated scanner with no verification.

• test against a live venue's tables
• access, modify or delete data that is not yours
• run load or denial of service tests against the deployed application

If you need to test something that would affect real data, ask first on a private channel and we will set up an isolated venue.