Security fixes are generally provided for the latest release of Bassin available through the Umbrel app store and the repository's current default branch.

If you believe you have found a security vulnerability in Bassin, please report it privately.

Please email: hello@blockdyor.com

For sensitive reports, encrypt your message with the public GPG key for blockdyor:

• Fingerprint: FBCC 7A51 65C9 71BF
• Public key: https://blockdyor.com/contact/

Please include as much of the following as possible:

• A clear description of the issue
• Steps to reproduce
• Affected version(s) and environment
• Any relevant logs, screenshots, or proof-of-concept information
• Whether the issue is public or already known

• We will acknowledge receipt of your report as soon as possible.
• We will work with you on a coordinated disclosure timeline where appropriate.
• We may ask for additional details or a patch before making any public statement.
• If you prefer, we can credit you in the disclosure note after the issue is resolved.

We are primarily interested in vulnerabilities that could lead to:

• Unauthorized access or privilege escalation
• Data exposure or loss
• Remote code execution or command injection
• Integrity issues in the app, container, or deployment flow

Issues in third-party dependencies or upstream projects should be reported to the appropriate upstream maintainer unless they are directly exploitable through Bassin.

Please do not use the security reporting channel for general bugs or feature requests. For those, open an issue in the repository or use the normal project channels.