Security Reporting and Deployment¶
Before public publication, maintainers must configure a monitored confidential vulnerability-reporting route and document supported release versions in each public repository's security policy. These docs do not yet advertise a contact address or response-time commitment.
When the public repository enables private vulnerability reporting, use that channel for suspected vulnerabilities. If no confidential route is available, ask maintainers to provide one without posting exploit details, credentials, or sensitive data. Ordinary issues are appropriate for non-sensitive bug reports.
Configurations, scripts, plugins, and environment setup commands are executable inputs. Use trusted sources and inspect examples before running them. Browser access to docs is read-only static serving, while the GUI can submit jobs. Binding either server to a reachable interface requires appropriate network access control; do not assume authentication or transport encryption is provided.
For a local preview:
Remove sensitive identifiers from logs, saved configurations, registry files, screenshots, and example inputs before sharing a report.