---
title: Security Advisories
description: Tracked CVEs, remediation status, and dependency security notes for Sencho's Docker image.
---

This page documents security-relevant changes across Sencho releases.

## April 2026 — Application Security Hardening

Version 0.25.2 includes application security hardening improvements:

- **Stricter file permissions** on sensitive files in the data directory, with automatic correction on startup
- **Stronger password requirements** aligned with [NIST SP 800-63B](https://pages.nist.gov/800-63-3/sp800-63b.html) recommendations
- **Reduced information disclosure** in application logs to prevent leaking sensitive details to logging aggregators

<Note>
  Users on versions prior to 0.25.2 should upgrade promptly. These improvements are applied automatically — no manual action is required.
</Note>

---

## Dependency Security

Sencho's Docker image bundles Docker CLI and Docker Compose as statically linked Go binaries. Vulnerabilities in Go's standard library or their Go dependencies surface as CVEs against the Sencho image even though Sencho itself contains no Go source code.

Sencho tracks and remediates these CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle.

<Note>
  If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/SaelixCode/sencho/releases) where each release documents dependency changes.
</Note>