# Security Policy

## Reporting vulnerabilities

Please report suspected vulnerabilities privately by emailing <security@urun.sh>.

Do not open a public GitHub issue for security-sensitive reports. Include:

- affected package and version,
- reproduction steps or proof of concept,
- impact and suggested remediation if known.

We will acknowledge reports as quickly as possible and coordinate disclosure after a fix is available.

## Browser SDK guidance

- Do not embed server API keys or other long-lived secrets in browser bundles.
- Browser clients should pass `orgId` plus a user/session JWT. urun validates that JWT server-side using the JWKS URL provisioned for the organization, such as a WorkOS client ID mapped during setup.
- Treat media tracks, session documents, and WebRTC data as potentially sensitive user/session data.
- Use environment-specific `baseUrl`, `orgId`, `jwt`, and auth provider configuration; avoid committing local tokens or generated config.
- Prefer short-lived browser/session JWTs issued by the configured auth provider over static secrets.
- Be careful when logging session document contents or media/session identifiers in production applications.