1.2 KiB
Security policy
Supported version
Security fixes are generally prepared for the current released version. Update older installations before requesting a detailed analysis whenever possible.
Reporting a vulnerability
Do not publish credentials, tokens, personal data, internal addresses, or exploitable details in a public issue.
Use the repository's private security-reporting feature when available. Otherwise, use the private contact listed in the repository and disclose only the information required to reproduce the issue.
A report should include:
- affected version
- affected function
- reproducible steps
- potential impact
- relevant log excerpts with all secrets removed
Only test systems for which you have explicit authorization.
Deployment secrets and runtime data
Keep .env and persistent runtime directories such as data/config, data/postgres, data/uploads, data/logs, and data/backups outside source control. They are deployment data rather than application source and can contain credentials or operational information.
For Internet-facing callbacks, publish only the dedicated callback listener through the firewall or reverse proxy. The normal AssetManager web port should remain on the intended administrative network.