Do not report security vulnerabilities through public GitHub issues.

Please report security vulnerabilities by opening a GitHub Security Advisory on the repository.

Include in your report:

• Description of the vulnerability
• Steps to reproduce
• Affected component(s) and version(s)
• Potential impact assessment
• Any suggested remediation (optional)

We aim to acknowledge reports within 48 hours and provide an initial assessment within 7 days. If the issue is confirmed, we will work toward a fix and coordinated disclosure.

• All auth enforced server-side — the API validates every request independently of the UI
• Passwords hashed with bcrypt — never stored in plaintext
• JWT access tokens — short-lived (configurable, default 15 min); refresh tokens hashed before storage
• Append-only audit log — every mutation is recorded before the response is returned
• No hardcoded secrets — all credentials via environment variables or mounted secrets
• API tokens hashed with SHA-256 — only the prefix is stored for identification
• RBAC with group-scoped permissions — roles are assigned to groups, groups to users

• The default admin password is admin with force_password_change=True. Change it immediately on first login.
• The API is unauthenticated internally on the Docker bridge network — do not expose PostgreSQL or Redis ports externally.
• TLS termination should be handled by a reverse proxy (nginx, Caddy) or load balancer in front of the frontend container.

We use GitHub Dependabot for automated dependency updates. Critical security patches are applied as soon as feasible.