SECURITY.md

Security Policy

Reporting a Vulnerability

Please do not open a public issue for security vulnerabilities. Instead, report them privately to the maintainers so they can be triaged and fixed before disclosure.

Include in your report:

• A description of the vulnerability and the affected endpoints/components.
• Steps to reproduce (if possible).
• Impact assessment.

Supported Versions

Security fixes are backported to the latest stable release. Older versions are not actively patched — please upgrade to the current release.

Known Scope

This project runs a public JSON API and an admin dashboard. A current threat model and mitigation checklist is maintained in docs/SECURITY.md — please review it before deploying to an untrusted network.

Disclosure Timeline

• Acknowledgement — within 72 hours of the report.
• Fix — a patched release is published as soon as the fix is verified.
• Disclosure — public mention of the vulnerability after the fix ships.