34 lines
1.7 KiB
Markdown
34 lines
1.7 KiB
Markdown
# Security
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not post passwords, access tokens, encryption keys, database exports, backup
|
|
files or live exploit details in public issues, discussions or container logs.
|
|
Non-sensitive security hardening reports may be filed at
|
|
https://git.amslabs.net/Rephl3x/Magent-Public/issues/new after removing all
|
|
deployment details and secrets. The public preview does not yet publish a
|
|
monitored confidential-reporting channel. Do not put embargoed vulnerabilities,
|
|
live exploits or sensitive evidence in a public issue. If a report cannot be
|
|
made safely in public, retain it until a private contact is listed here.
|
|
|
|
Reports are handled on a best-effort basis. The project does not promise a
|
|
specific response time or security-support window. The newest public preview is
|
|
the only version considered for security fixes unless a release note says otherwise.
|
|
|
|
Include the image tag/digest, affected version, a minimal reproduction using
|
|
synthetic data, and the security impact. Remove deployment credentials and
|
|
personal data from attachments. Do not test against systems you do not own or
|
|
have permission to assess.
|
|
|
|
## Deployment precautions
|
|
|
|
Follow [the public installation guide](docs/PUBLIC_RELEASE.md): use HTTPS for
|
|
public access, independent random secrets, a protected persistent data volume,
|
|
and the exact browser-facing origin. Keep the original signing/encryption keys
|
|
when upgrading. Do not disable origin checks or run as root to work around a
|
|
deployment failure.
|
|
|
|
Use a reviewed immutable release image and retain a tested backup. Check the
|
|
release's declared architecture support and migration notes. The project has
|
|
not declared an LTS support window or a guaranteed security-response SLA.
|