Security

Security

Status: documentation skeleton

Principles

• Keep API keys, database passwords, and encryption keys server-side.
• Use HTTPS in production.
• Validate and constrain external URLs and user-controlled content.
• Keep database and internal service ports off the public interface.
• Review logs and backups for accidental secret exposure.

Reporting a vulnerability

Please do not publish exploitable vulnerability details in a public issue. Use the repository's private security reporting channel when available, or contact the maintainers before disclosure.

Planned details

• Add threat model and trust boundaries.
• Document secret rotation.
• Document authentication and authorization assumptions.
• Add a production security checklist.