20 lines
663 B
Markdown
20 lines
663 B
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
Security fixes are applied to the latest release branch and `main`.
|
|
|
|
## Reporting a vulnerability
|
|
Do not open public issues for security vulnerabilities.
|
|
|
|
Until a dedicated private inbox is configured, report privately to repository
|
|
maintainers and include:
|
|
- Impact summary
|
|
- Reproduction steps
|
|
- Affected versions or commit hash
|
|
- Suggested mitigation (if available)
|
|
|
|
## Secret handling guidance
|
|
- Never commit real passwords, private keys, tokens, or host fingerprints.
|
|
- Use `--store-password` and key passphrase flags only in local trusted setups.
|
|
- Treat exported encrypted bundles (`*.enc`) as sensitive artifacts.
|