Please report vulnerabilities privately through GitHub's private vulnerability reporting. Do not open a public issue.

Include what you found, how to reproduce it, the affected version or commit, and, if possible, the X-Request-Id of a relevant response. You can expect an acknowledgement within 5 working days and a status update at least every two weeks until the issue is resolved. Please give a reasonable time to fix the issue before disclosing it.

In scope: the API (server/), the web client (client/), the container images and the deployment configuration in this repository.

Out of scope: denial of service by volume, findings that require a compromised device or browser, missing headers without a demonstrated impact, and reports produced only by automated scanners.

• The application is served over HTTPS behind the provided Caddy configuration (or an equivalent proxy that overwrites X-Forwarded-For).
• Secrets (JWT_SECRET, database and SMTP credentials) are supplied through the environment and are never committed.
• PostgreSQL is reachable only from the application network.
• /metrics and Swagger are not exposed to the internet in production.

The security model is described in docs/security.md.

Before v1.0.0, database credentials for a hosted PostgreSQL instance and its CA certificate were committed to this repository. They were removed from the code in v1.0.0 but remain in Git history and must be treated as compromised. The owner must rotate that password at the provider.