Security fixes are released for the latest published version of Astro Rocket. The theme is distributed by cloning the repository, so the way to receive a fix is to update from upstream — see the update guide on the theme blog.

Please do not open a public issue for a security problem. A public report tells everyone running the theme about the weakness before there is a fix.

Report it privately in one of two ways:

1. GitHub Security Advisories — preferred. Go to the repository's Security tab and choose Report a vulnerability. This keeps the report private and creates a place to discuss the fix.
2. Email — hello@hansmartens.dev, if you would rather not use GitHub.

Useful things to include, as far as you can:

• what the problem is, and what an attacker could achieve with it
• the affected file, route or component
• steps to reproduce, or a proof of concept
• the version or commit you found it on

• An acknowledgement that the report arrived, within a few days.
• An assessment of whether it is reproducible and how serious it is.
• A fix released as soon as it is ready, with the problem described in the changelog once users have had the chance to update.
• Credit for the report, unless you prefer not to be named.

This is a free, MIT-licensed project maintained by one person, so there is no bug bounty and no guaranteed response time. Reports are taken seriously regardless.

A few things are your responsibility rather than the theme's:

• Keep secrets out of the repository. API keys belong in environment variables, not in committed files. .env is gitignored for that reason.
• Server-side keys stay server-side. Anything named PUBLIC_ is visible to every visitor. Never put a private key behind that prefix.
• Update your dependencies. Most vulnerabilities in a site built on this theme will come from packages, not from the theme's own code.
• Check your own additions. Forms, API routes and third-party embeds you add are outside the theme's control and its testing.