# Security policy

## Supported state

DevRunbook is a self-hosted application and its deployment manifests, web
service, worker, database schema, import boundaries and build-pack contracts are
in scope. Until a stable release is tagged, security fixes target the latest
commit on the canonical `main` branch. After stable releases begin, this section
will list the supported version series explicitly.

## Reporting a vulnerability

Do not place credentials, tokens, private repository contents or exploit details
in a public issue. Report vulnerabilities privately to
[`security@itworx.tech`](mailto:security@itworx.tech). If email is unavailable,
contact the operator of your deployment through its documented private channel.

A useful report includes the affected contract or file, impact, minimal reproduction, preconditions and a redacted proof. Never include live secrets.

## Security boundaries

DevRunbook must not execute arbitrary repository commands, must treat imported
content as untrusted data, must keep Gitea read-only and must enforce the
controls in `docs/13-security-privacy-threat-model.md` and
`docs/26-authentication-authorization.md`.