Row-Template follows semantic versioning. Security fixes are released against the latest stable version. Older versions are not maintained — update to the latest release before reporting an issue.

Please report security issues privately so they can be fixed before public disclosure. Do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting for this repository:

1. Go to the repository's Security tab.
2. Choose Report a vulnerability (Private vulnerability reporting).
3. Describe the issue, the affected version (row-template version), and clear reproduction steps.

If private reporting is unavailable to you, open a minimal public issue that asks a maintainer to enable private reporting — without including any exploit details or sensitive data.

• Row-Template version (row-template version).
• 3X-UI (Xray panel) version and operating system.
• A clear description and reproduction steps.
• Impact assessment, if you have one.

Never paste secrets into a report or a public issue. This includes:

• Subscription URLs, subId values, client UUIDs.
• Panel usernames, passwords, cookies, session tokens, or API tokens.
• The panel's webBasePath, TLS private keys, or certificates.
• Server IP addresses or hostnames you do not want made public.

Redact these before sharing any logs or command output.

Every release is distributed with a mandatory SHA-256 checksum, and the installer refuses to continue on a mismatch. For the full trust model — what the checksum does and does not prove, how to verify a build independently, and the optional signed-tag path for publisher authenticity — see PROVENANCE.md.

Row-Template generates and serves a static subscription page from the administrator's own server. It has no backend of its own, makes no third-party network requests from the served page, and never transmits subscriber data anywhere. Reports about the underlying 3X-UI panel or Xray-core belong to their respective projects.