1.1 KiB
Security policy
Supported state
DevRunbook is a self-hosted application and its deployment manifests, web
service, worker, database schema, import boundaries and build-pack contracts are
in scope. Until a stable release is tagged, security fixes target the latest
commit on the canonical main branch. After stable releases begin, this section
will list the supported version series explicitly.
Reporting a vulnerability
Do not place credentials, tokens, private repository contents or exploit details
in a public issue. Report vulnerabilities privately to
security@itworx.tech. If email is unavailable,
contact the operator of your deployment through its documented private channel.
A useful report includes the affected contract or file, impact, minimal reproduction, preconditions and a redacted proof. Never include live secrets.
Security boundaries
DevRunbook must not execute arbitrary repository commands, must treat imported
content as untrusted data, must keep Gitea read-only and must enforce the
controls in docs/13-security-privacy-threat-model.md and
docs/26-authentication-authorization.md.