We take security seriously. If you discover a security vulnerability in any of our stack templates, tooling, or documentation, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, use one of the following channels:

• Email: security@secure-stacks.dev
• GitHub Security Advisories: Submit via GitHub

Please include:

• A description of the vulnerability
• Steps to reproduce the issue
• Affected stack/template(s)
• Potential impact assessment
• Suggested fix (if available)

We will keep you informed of our progress throughout the process.

• All Docker Compose templates in templates/
• All stack configurations in stacks/
• Validation and scoring scripts in scripts/
• CI/CD pipeline configurations in .github/
• Documentation that could lead to insecure deployments
• Default configurations that introduce security weaknesses

• Vulnerabilities in upstream dependencies (report to the respective project)
• Social engineering attacks against maintainers
• Denial of service attacks against the repository or infrastructure
• Issues requiring physical access to a user's environment
• Third-party services referenced in templates (report to their maintainers)

We do not currently offer a monetary bug bounty program. However, we recognize and appreciate security researchers who help improve the project:

• Public acknowledgment in our SECURITY.md and release notes (with your permission)
• Hall of Fame listing for verified vulnerability reports
• Contributor badge on the project for repeat contributors

We believe in building a security-conscious community and value every report that helps make these templates safer for all developers.

When using our templates, we recommend:

1. Always use the latest version of a template
2. Review and customize security settings for your specific deployment
3. Never commit .env files or secrets to version control
4. Regularly update dependencies and re-scan for vulnerabilities
5. Run the provided security tests before deploying to production

This security policy is inspired by industry best practices and the GitHub Security Advisories framework.