# Security policy

## Supported version

Security fixes are generally prepared for the current released version. Update older installations before requesting a detailed analysis whenever possible.

## Reporting a vulnerability

Do not publish credentials, tokens, personal data, internal addresses, or exploitable details in a public issue.

Use the repository's private security-reporting feature when available. Otherwise, use the private contact listed in the repository and disclose only the information required to reproduce the issue.

A report should include:

- affected version
- affected function
- reproducible steps
- potential impact
- relevant log excerpts with all secrets removed

Only test systems for which you have explicit authorization.

## Deployment secrets and runtime data

Keep `.env` and persistent runtime directories such as `data/config`, `data/postgres`, `data/uploads`, `data/logs`, and `data/backups` outside source control. They are deployment data rather than application source and can contain credentials or operational information.

For Internet-facing callbacks, publish only the dedicated callback listener through the firewall or reverse proxy. The normal AssetManager web port should remain on the intended administrative network.