Security
This page summarizes the project's security policy: how to report a vulnerability, which versions are supported, and the deployment note on running the system safely.
Reporting a vulnerability
Please do not open a public issue for security vulnerabilities.
Instead, open a private GitHub Security Advisory or contact the repository owner directly. We aim to acknowledge reports within a few days.
If a credential or personal data was committed by mistake, do not paste the value into an issue. Revoke/rotate it first, then report privately so history can be cleaned.
Supported versions
This project is developed on the main branch; security fixes land there. Pin to a commit
and update deliberately.
Deployment note
This system is designed to run on your internal network — the database, files and credentials stay entirely on your server and nothing leaves. The public request portal is intentionally passwordless; access is via unguessable token links.
External access can be opened safely in three ways: a VPN tunnel, an IP allowlist, or an authenticating reverse proxy. We only advise against plain (unauthenticated) internet exposure without one of these access-control layers. For deployment and hardening guidance see Installation.