Puranjay Savar Mattas
8c35710521
CODEOWNERS, CONTRIBUTING.md, SECURITY.md, SETUP.md, and the .gitea issue/PR templates, rewritten for Outpost (they started as copies from an unrelated project's templates - stripped the cross-repo/ticket-ID conventions and the entirely different tech stack in SETUP.md, replaced with this repo's actual submodule/OutlineKit/Xcode workflow).
39 lines
1.2 KiB
Markdown
39 lines
1.2 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in Outpost, please do **not**
|
|
open a public issue.
|
|
|
|
Report it privately to: **security@psmattas.com**
|
|
|
|
Include:
|
|
- A description of the vulnerability
|
|
- Steps to reproduce
|
|
- Potential impact
|
|
- Any suggested fixes if available
|
|
|
|
We will acknowledge receipt within 48 hours and aim to release a fix
|
|
within 14 days depending on severity.
|
|
|
|
## Supported Versions
|
|
|
|
Outpost is in early alpha (`0.0.x`) — there's no stable release line
|
|
yet. Only the most recent tagged release receives fixes; please make
|
|
sure you're on the latest alpha before reporting.
|
|
|
|
| Version | Supported |
|
|
| :--- | :---: |
|
|
| Latest tagged release | ✅ |
|
|
| Older releases | ❌ |
|
|
|
|
## Scope
|
|
|
|
Outpost is a client application that talks to a self-hosted Outline
|
|
instance you control — it doesn't run any server infrastructure of its
|
|
own. Vulnerabilities in Outline itself belong to
|
|
[outline/outline](https://github.com/outline/outline), not this repo.
|
|
API tokens are stored in the system Keychain only (never `UserDefaults`,
|
|
never logged) — see [`CLAUDE.md`](CLAUDE.md) for the relevant
|
|
conventions if you're reviewing that code path.
|