Security fixes are applied to the latest default branch.

Do not open a public issue for security vulnerabilities.

Report vulnerabilities privately to the maintainers and include:

• Affected component(s)
• Reproduction steps
• Impact assessment
• Suggested remediation (if available)

If you do not have a private contact channel yet, ask a maintainer to establish one before sharing details publicly.

Run these checks before creating a release or publishing a security-sensitive change:

• Install tools used by pre-commit hooks: gosec, govulncheck, and trivy.
• Run: pre-commit run --all-files

• Use a patched Go toolchain compatible with this repository's Go version.
• gosec ./...
• govulncheck ./...

• cd frontend && npm ci && npm audit --audit-level=high

• pre-commit run --all-files

• trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL --exit-code 1 .

• Never commit .env or kube credentials.
• Rotate secrets if exposure is suspected.
• Keep dependencies up to date and patch high severity vulnerabilities quickly.
• Prefer least-privilege Kubernetes and database credentials for deployments.