Report suspected authentication vulnerabilities privately. Use public issues for ordinary bugs and documentation corrections.
Report a vulnerability
Use GitHub’s private vulnerability report. Include the affected version or development revision, Ruby/Rails versions, potential impact and reproducible steps. Follow the gem’s security policy for reporting alternatives and support expectations.
Do not post live passwords, session cookies, provider secrets or sign-in links in public issues or screenshots. Avoid public disclosure of a suspected vulnerability before a fix is available.
What to review in your host
Your app owns account eligibility, account provisioning, password resets, mail delivery, durable jobs, shared rate-limit storage and deployment configuration. Review those boundaries when adopting AddAuth or customizing its pages.
Keep account-security changes within the supported Rails lifecycle. Direct database writes can bypass session and token invalidation callbacks. Verify your customized host instead of treating a library check as deployment acceptance.
Get help or correct a page
- Troubleshooting covers common sign-in and delivery symptoms.
- Gem issues are for reproducible product bugs.
- Docs issues are for unclear or incorrect instructions.
Check the release state
These docs describe unreleased 0.2.0.dev. Consult release status before planning adoption, and the gem’s security policy once a published release is available.