Security

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

Do NOT open a public issue
Use GitHub's private vulnerability reporting or email security concerns to the repository owner
Include steps to reproduce the issue
Allow reasonable time for a fix before public disclosure

Supported Versions

Version	Supported
Latest	Yes

Security Considerations

All API endpoints require Bearer token authentication
Tokens are bcrypt-hashed in the database
File uploads are validated and size-limited
Push notification keys should be stored securely and never committed to version control
The server should be deployed behind a reverse proxy with TLS

There aren’t any published security advisories