Please report vulnerabilities privately through GitHub's private vulnerability reporting. Do not open a public issue.
Include what you found, how to reproduce it, the affected version or commit,
and, if possible, the X-Request-Id of a relevant response. You can expect
an acknowledgement within 5 working days and a status update at least every
two weeks until the issue is resolved. Please give a reasonable time to fix
the issue before disclosing it.
| Version | Supported |
|---|---|
| 1.x | ✓ |
| < 1.0 (pre-rework code) | ✗ (known critical issues, see docs/audit-2026-11.md) |
In scope: the API (server/), the web client (client/), the container
images and the deployment configuration in this repository.
Out of scope: denial of service by volume, findings that require a compromised device or browser, missing headers without a demonstrated impact, and reports produced only by automated scanners.
- The application is served over HTTPS behind the provided Caddy
configuration (or an equivalent proxy that overwrites
X-Forwarded-For). - Secrets (
JWT_SECRET, database and SMTP credentials) are supplied through the environment and are never committed. - PostgreSQL is reachable only from the application network.
/metricsand Swagger are not exposed to the internet in production.
The security model is described in docs/security.md.
The audit of the pre-1.0 code (docs/audit-2026-11.md) found no secrets in
Git history. The only committed credential-like file was server/src/ca.pem,
a public CA certificate, which was removed in v1.0.0. The pre-1.0 local
configuration pointed at a hosted PostgreSQL instance through an uncommitted
local .env file. If that instance still exists, its owner should rotate the
password as a precaution.