Skip to content

Security: pmilano1/kindred

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in Kindred, please report it responsibly.

How to Report

  1. Do NOT open a public GitHub issue for security vulnerabilities
  2. Use GitHub Security Advisories to report privately
  3. Include:
    • Description of the vulnerability
    • Steps to reproduce
    • Potential impact
    • Suggested fix (if any)

What to Expect

  • Acknowledgment within 48 hours
  • Regular updates on progress
  • Credit in release notes (unless you prefer anonymity)

Scope

This policy applies to:

  • The Kindred application code
  • Default configurations
  • Documentation that could lead to insecure setups

Out of Scope

  • Issues in third-party dependencies (report to upstream)
  • Self-hosted instances with custom modifications
  • Social engineering attacks

Supported Versions

Version Supported
Latest ✅
< 1.0 ❌

Security Best Practices

When self-hosting Kindred:

  1. Use HTTPS - Always deploy behind TLS
  2. Strong secrets - Generate unique NEXTAUTH_SECRET values
  3. Database security - Use strong passwords, limit network access
  4. Keep updated - Pull latest images regularly
  5. Limit access - Use invite-only mode for private trees

There aren't any published security advisories