Pre-v1 reports should target the current develop branch. After the v1.0.0 release ships, security updates are supported for the current v1.0.x release line.

Please report suspected vulnerabilities privately through GitHub Security Advisories:

https://github.com/danner26/Safe-Harbor/security/advisories/new

If GitHub Security Advisories are not available to you, email support@danstechsupport.com with a clear description of the issue, affected versions, reproduction steps, and any relevant logs or screenshots.

Do not open a public issue for a suspected vulnerability before we have had a chance to review it.

In scope: app code in this repository.

Out of scope: vulnerabilities in third-party Postgres, Redis, Cloudflared, or other container images and upstream dependencies that are not maintained here. Please report those issues to the appropriate upstream project or vendor.

We aim to acknowledge vulnerability reports within 7 days.

We aim to complete initial triage within 30 days. After triage, we will either work on a fix, explain why the report is not considered a vulnerability in this project, or agree on a coordinated disclosure plan when additional time is needed.

We appreciate responsible reports and will credit reporters who want public recognition once a fix or coordinated disclosure plan is complete. Please tell us how you would like to be named. We may decline public credit for reports that are abusive, disclose details prematurely, or do not describe a security impact.