Spaces:
Paused
Paused
| # Security Policy | |
| ## Supported Versions | |
| Security fixes are applied to: | |
| - the latest code on `dev` | |
| - the latest published release tag, when a release exists | |
| Older branches and historical commits may not receive fixes. | |
| ## Reporting a Vulnerability | |
| Please report security issues privately and avoid opening a public issue with sensitive details. | |
| When reporting, include: | |
| - a clear summary of the issue | |
| - affected versions or commit SHA | |
| - reproduction steps or proof of concept | |
| - expected impact | |
| - any suggested mitigation | |
| If GitHub private vulnerability reporting is available for this repository, use it first. Otherwise, contact the maintainers privately before any public disclosure. | |
| ## Disclosure Expectations | |
| - Do not publish session tokens, auth files, temporary mailbox credentials, or other secrets in issues or pull requests. | |
| - Give maintainers reasonable time to validate and fix the problem before public disclosure. | |
| - If a fix requires configuration changes, please document the secure default behavior as part of the report. | |
| ## Operational Notes | |
| This project handles authentication state and related local files. In production-like environments, operators should: | |
| - restrict access to `.env`, `state.json`, `accounts.json`, and `auths/` | |
| - rotate exposed credentials immediately | |
| - avoid storing exported auth material in shared or world-readable locations | |