8 lines
621 B
Markdown
8 lines
621 B
Markdown
# Security policy
|
|
|
|
ForgeFlow can interact with local Git repositories, Gitea, update metadata and controlled deployment targets. Security-sensitive behavior is documented in [`docs/SECURITY.md`](docs/SECURITY.md).
|
|
|
|
Report vulnerabilities privately to the repository owner when disclosure could expose credentials, signing material, repository access details or deployment infrastructure.
|
|
|
|
Never commit Gitea tokens, SSH private keys, release-signing private keys, deployment credentials or local repository state. The packaged signing public key is intentionally public; private signing material must remain outside Git.
|