# Security policy

[Documentation](documents/README.md)

This repository contains deployment configuration, not the upstream
applications themselves. Report vulnerabilities in an upstream application to
that project's maintainers.

For repository-specific vulnerabilities, such as an exposed credential, unsafe
default, or configuration that unexpectedly publishes a service, use
[GitHub private vulnerability reporting](https://github.com/bolens/homelab/security/advisories/new).
Do not open a public issue containing credentials, tokens, private addresses,
or exploit details.

Expect an acknowledgement within 7 days. After validating a report, the
maintainer will coordinate remediation and disclosure with the reporter.
Critical issues should normally be fixed or mitigated within 30 days; lower
severity issues may take up to 90 days. Disclosure may be delayed when users
need additional time to deploy a safe migration.

The repository is distributed under the MIT License.