Jens/ForgeFlow
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 24 Wiki Activity

Add top-level security entry point

Browse Source
This commit is contained in:
Jens
2026-08-31 01:40:49 +02:00
parent 0bbfbbad51
commit 976a1fc0df
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+7
View File
@@ -0,0 +1,7 @@
# Security policy
ForgeFlow can interact with local Git repositories, Gitea, update metadata and controlled deployment targets. Security-sensitive behavior is documented in [`docs/SECURITY.md`](docs/SECURITY.md).
Report vulnerabilities privately to the repository owner when disclosure could expose credentials, signing material, repository access details or deployment infrastructure.
Never commit Gitea tokens, SSH private keys, release-signing private keys, deployment credentials or local repository state. The packaged signing public key is intentionally public; private signing material must remain outside Git.