Please don't open a public issue for a security problem. Use Report a vulnerability on this repository's Security tab, or write to kalfasyan@pm.me with which version (the image tag), what you found, how to reproduce it and what someone could do with it.

• You get a reply within 7 days.
• A critical problem, such as reading or changing data that isn't yours or taking over the server, is fixed in a new release within 7 days of confirming it. Other problems are fixed in a release within 30 days.
• Once the fix is released, a security advisory says what was wrong, which versions were affected and how to update. It credits you, unless you'd rather not be named.
• There is no bug bounty.

Fixes go into a new release of the newest version. Installs follow its major version (:1), so docker compose pull or selfhostit update brings the fix; older releases are not patched. See docs/deploy.md.

The "Security and maintenance" section of the README, and for every selfhostit app, Security and privacy.