# Security Policy

## Reporting a vulnerability

Do not report vulnerabilities through public issues or discussions.

Use GitHub's private vulnerability reporting for this repository. Open the
Security tab, select Advisories, and choose "Report a vulnerability". If the
button is not available, wait until a private reporting channel is listed here
rather than publishing technical details.

Include, where possible:

- the affected application entry, recipe, or generated configuration;
- the conditions and steps needed to reproduce the issue;
- the security impact and affected versions;
- a minimal, non-destructive proof of concept;
- any suggested mitigation.

Do not include real credentials, personal data, or data taken from systems you
do not own or have permission to test.

## Scope

This policy covers catalog data, Docker Compose recipes, proxy examples,
installation instructions, and backup, restore, and smoke-test scripts in this
repository. Report a vulnerability in an upstream application to that
application's security team unless a Fossary recipe or instruction introduces
or materially increases the risk.

The project has no bug bounty program. Good-faith, non-destructive research and
coordinated disclosure are welcome.