ITWorx-Pulse-Public/SECURITY.md

Security Policy

Supported code

Security fixes target the current release line on master. Older releases may receive a fix when the same issue is still relevant and a safe backport is practical.

Reporting vulnerabilities

Report suspected vulnerabilities privately. Do not open a public issue containing access tokens, OIDC secrets, session material, private dashboards, host inventories, alert payloads, infrastructure topology, backup contents, database credentials, production telemetry, or exploit-sensitive evidence.

Include the affected release or commit, component, minimal reproduction conditions using synthetic telemetry where possible, expected and observed behaviour, and impact. Call out effects on authentication/RBAC, query bounds, WebSocket subscriptions, agent isolation, backup/restore, deployment, secret handling, or the read-only product boundary.

Email reports to security@itworx.tech. This monitored mailbox is the permanent private reporting channel for the project.

Security boundary

Pulse is an observability product. Contributions must not silently introduce mutation of monitored Unraid, storage, container, service, or network resources. Unknown or stale telemetry remains explicit, authentication fails closed, and runtime containers retain their documented least-privilege boundaries.

Never commit live .env files, production credentials, private backups, unredacted production data, or operator-specific infrastructure evidence. Agent instructions and engineering evidence retained in the canonical private repository are development context, not executable production authority; public source archives exclude that context through .gitattributes.