We provide security updates for the following versions:

If you discover a security vulnerability, please follow these steps:

Security vulnerabilities should not be disclosed publicly until they are resolved.

Please use GitHub's private vulnerability reporting feature:

Or use GitHub's private vulnerability reporting:

1. Go to the Security tab
2. Click Report a vulnerability
3. Fill out the form with details

• 📋 Description of the vulnerability
• 🔄 Steps to reproduce
• 🎯 Potential impact
• 💡 Suggested fix (if you have one)
• 🖥️ Affected versions/configurations

This repository contains:

• ✅ Safe: Configuration templates and examples
• ⚠️ Caution: Some services may expose network ports
• ❌ Avoid: Never commit passwords or private keys

• 🔒 No hardcoded passwords (uses initialPassword for first setup)
• 🚫 SSH root login disabled by default
• 🔥 Firewall enabled by default
• 🔑 Password authentication disabled for SSH
• 🧹 Regular dependency updates via automation

• 🔄 Change default passwords after first login
• 🔑 Set up SSH keys properly
• 🔒 Review and customize firewall rules
• 📦 Keep system updated with nix flake update
• 🔍 Audit optional services before enabling

• Initial Response: Within 24 hours
• Assessment: Within 72 hours
• Fix Development: Varies by complexity
• Public Disclosure: After fix is available

We appreciate security researchers who help make this project safer:

• 🙏 Contributors will be credited (unless they prefer anonymity)
• 📢 Public acknowledgment in release notes
• 🎖️ Hall of Fame section (if applicable)

• NixOS Security
• Nix Security Model
• Home Manager Security

Built into CI/CD:

• 🔍 TruffleHog - Secret scanning
• 🔒 Custom checks - Password detection
• 🔄 Automated updates - Dependency freshness

🔒 Remember: Security is everyone's responsibility. When in doubt, ask! 🤝