26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# Security policy
|
|
|
|
## Supported state
|
|
|
|
DevRunbook is a self-hosted application and its deployment manifests, web
|
|
service, worker, database schema, import boundaries and build-pack contracts are
|
|
in scope. Until a stable release is tagged, security fixes target the latest
|
|
commit on the canonical `main` branch. After stable releases begin, this section
|
|
will list the supported version series explicitly.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not place credentials, tokens, private repository contents or exploit details
|
|
in a public issue. Report vulnerabilities privately to
|
|
[`security@itworx.tech`](mailto:security@itworx.tech). If email is unavailable,
|
|
contact the operator of your deployment through its documented private channel.
|
|
|
|
A useful report includes the affected contract or file, impact, minimal reproduction, preconditions and a redacted proof. Never include live secrets.
|
|
|
|
## Security boundaries
|
|
|
|
DevRunbook must not execute arbitrary repository commands, must treat imported
|
|
content as untrusted data, must keep Gitea read-only and must enforce the
|
|
controls in `docs/13-security-privacy-threat-model.md` and
|
|
`docs/26-authentication-authorization.md`.
|