Assetmanager/SECURITY.md

Security policy

Supported version

Security fixes are generally prepared for the current released version. Update older installations before requesting a detailed analysis whenever possible.

Reporting a vulnerability

Do not publish credentials, tokens, personal data, internal addresses, or exploitable details in a public issue.

Use the repository's private security-reporting feature when available. Otherwise, use the private contact listed in the repository and disclose only the information required to reproduce the issue.

A report should include:

• affected version
• affected function
• reproducible steps
• potential impact
• relevant log excerpts with all secrets removed

Only test systems for which you have explicit authorization.