1.5 KiB
Security Policy
Supported code
Security fixes target the current main branch.
Reporting vulnerabilities
Report suspected vulnerabilities privately to the repository owner. Do not include API keys, access tokens, passwords, private hostnames or addresses, infrastructure inventories, configuration exports, uploaded media, personal data, or exploit-sensitive diagnostics in a public issue.
A useful report identifies the affected commit or component, minimal reproduction conditions using synthetic data, expected and observed behaviour, and impact. Mention whether the issue affects provider credential handling, inventory ingestion, the read-only Docker/AppOps boundary, external-access assumptions, request validation, stored configuration, import/export, frontend secret masking, or deployment.
Security model
DockDeck can expose infrastructure inventory and launch URLs. It is designed for a trusted local network and does not assume that direct internet exposure is safe. Preserve loopback-by-default publishing, read-only integrations, explicit reverse-proxy authentication, and least-privilege socket-proxy or AppOps permissions.
Contributions must not add Docker mutations or unrestricted socket access, expose provider secrets to API responses or browser bundles, or weaken the documented local deployment boundary without an explicit security design.
Never commit live .env files, operational credentials, private inventories, configuration exports, uploaded media, or deployment keys. Use .env.example for non-secret configuration examples.