Gamatrain takes security seriously. This document outlines how to report vulnerabilities and best practices for keeping our frontend secure.

If you discover a security vulnerability in the Gamatrain frontend, please report it responsibly.

Report via: Gamatrain Contact Form

Please include:

• A detailed description of the vulnerability
• Steps to reproduce the issue
• Impact assessment
• Any supporting screenshots or logs
• The affected page, component, or endpoint

Important: Do not publicly disclose the vulnerability until a fix has been released.

We will respond within 48 hours and acknowledge your contribution once the issue is resolved.

• Use secure authentication flows (OAuth2, JWT, or session cookies with HttpOnly and Secure flags).
• Avoid storing sensitive tokens in localStorage; prefer HttpOnly cookies.
• Implement automatic token expiration and refresh flows.

• Validate and sanitize all user inputs on the frontend.
• Prevent XSS by escaping content in templates and using Nuxt’s built-in sanitization.
• Avoid unsafe usage of v-html unless sanitized.

• Always use HTTPS / TLS 1.2+ for API calls.
• Protect sensitive data in the browser; avoid storing secrets in the client.

• Keep npm / yarn packages up-to-date.
• Monitor for vulnerabilities using npm audit or Snyk.

• Do not log sensitive information (passwords, tokens) to the console.
• Monitor frontend errors and suspicious patterns using tools like Sentry.

• Implement Content Security Policy (CSP) headers to mitigate XSS attacks.
• Use strict CORS policies when calling APIs.

• Security patches and updates will be documented in the release notes.
• Users and contributors are encouraged to update to the latest version immediately after a release.

We appreciate security researchers and community members who responsibly report vulnerabilities.
All contributors will be credited if they wish to be publicly acknowledged.