28 lines
1.2 KiB
Markdown
28 lines
1.2 KiB
Markdown
# Security policy
|
|
|
|
## Supported version
|
|
|
|
Security fixes are generally prepared for the current released version. Update older installations before requesting a detailed analysis whenever possible.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not publish credentials, tokens, personal data, internal addresses, or exploitable details in a public issue.
|
|
|
|
Use the repository's private security-reporting feature when available. Otherwise, use the private contact listed in the repository and disclose only the information required to reproduce the issue.
|
|
|
|
A report should include:
|
|
|
|
- affected version
|
|
- affected function
|
|
- reproducible steps
|
|
- potential impact
|
|
- relevant log excerpts with all secrets removed
|
|
|
|
Only test systems for which you have explicit authorization.
|
|
|
|
## Deployment secrets and runtime data
|
|
|
|
Keep `.env` and persistent runtime directories such as `data/config`, `data/postgres`, `data/uploads`, `data/logs`, and `data/backups` outside source control. They are deployment data rather than application source and can contain credentials or operational information.
|
|
|
|
For Internet-facing callbacks, publish only the dedicated callback listener through the firewall or reverse proxy. The normal AssetManager web port should remain on the intended administrative network.
|