pxmon/SECURITY.md

Security Policy

Supported versions

Security fixes are applied to the latest release branch and main.

Reporting a vulnerability

Do not open public issues for security vulnerabilities.

Until a dedicated private inbox is configured, report privately to repository maintainers and include:

• Impact summary
• Reproduction steps
• Affected versions or commit hash
• Suggested mitigation (if available)

Secret handling guidance

• Never commit real passwords, private keys, tokens, or host fingerprints.
• Use --store-password and key passphrase flags only in local trusted setups.
• Treat exported encrypted bundles (*.enc) as sensitive artifacts.