If you discover a security vulnerability in Echo Mock Server, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email: boloage@gmail.com.

Please do not include credentials, production data, or other secrets in a public issue.

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: within 48 hours
• Initial assessment: within 7 days
• Fix release: depends on severity, typically within 30 days

When deploying Echo Mock Server in production:

1. Change default credentials — Replace the default admin/admin password via ECHO_ADMIN_PASSWORD environment variable
2. Set a unique Remember Me key — Override ECHO_REMEMBER_ME_KEY with a random secret
3. Keep optional features off unless you need them — Self-registration, bulk import/export and issue reporting are off by default; see docs/configuration.md and docs/install.md
4. Use HTTPS — Deploy behind a reverse proxy (e.g., Nginx) with TLS termination
5. Restrict network access — Echo is designed for internal/testing environments; do not expose to the public internet without proper access controls