1.7 KiB
Security
Reporting a vulnerability
Do not post passwords, access tokens, encryption keys, database exports, backup files or live exploit details in public issues, discussions or container logs. Non-sensitive security hardening reports may be filed at https://git.amslabs.net/Rephl3x/Magent-Public/issues/new after removing all deployment details and secrets. The public preview does not yet publish a monitored confidential-reporting channel. Do not put embargoed vulnerabilities, live exploits or sensitive evidence in a public issue. If a report cannot be made safely in public, retain it until a private contact is listed here.
Reports are handled on a best-effort basis. The project does not promise a specific response time or security-support window. The newest public preview is the only version considered for security fixes unless a release note says otherwise.
Include the image tag/digest, affected version, a minimal reproduction using synthetic data, and the security impact. Remove deployment credentials and personal data from attachments. Do not test against systems you do not own or have permission to assess.
Deployment precautions
Follow the public installation guide: use HTTPS for public access, independent random secrets, a protected persistent data volume, and the exact browser-facing origin. Keep the original signing/encryption keys when upgrading. Do not disable origin checks or run as root to work around a deployment failure.
Use a reviewed immutable release image and retain a tested backup. Check the release's declared architecture support and migration notes. The project has not declared an LTS support window or a guaranteed security-response SLA.