Security Policy

Supported Versions

Version	Supported
latest	✅

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via email to security@temps.sh.

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the following information in your report:

Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
Full paths of source file(s) related to the issue
The location of the affected source code (tag/branch/commit or direct URL)
Any special configuration required to reproduce the issue
Step-by-step instructions to reproduce the issue
Proof-of-concept or exploit code (if possible)
Impact of the issue, including how an attacker might exploit it

We will acknowledge receipt of your vulnerability report within 48 hours.
We will provide an estimated timeline for a fix within 7 days.
We will notify you when the vulnerability is fixed.
We will publicly disclose the vulnerability after a fix is available, crediting you (unless you prefer to remain anonymous).

When deploying Temps, please ensure:

Use HTTPS — Always configure TLS certificates for your deployment.
Strong passwords — Use strong passwords for admin accounts and database connections.
Firewall rules — Restrict access to management ports (see docs/server-firewall-setup.md).
Keep updated — Run temps upgrade regularly to get the latest security patches.
Database security — Use strong PostgreSQL credentials and restrict network access.
API keys — Rotate API keys periodically and use the minimum required permissions.

The following are in scope:

The following are out of scope: