mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
8e0857e7f6
Surface six dedicated email channels (support, contact, licensing, security, privacy, conduct) across contextually appropriate locations: - security.txt: create .well-known/security.txt for app (RFC 9116) - SECURITY.md: add security@sencho.io as alternative to GitHub reporting - PaidGate/AdmiralGate: add licensing@sencho.io to upgrade prompts - docs: new Contact & Support reference page listing all channels - CHANGELOG: document additions under [Unreleased] Website changes (separate repo): privacy@sencho.io in Privacy/Terms pages, licensing@sencho.io in Refund page and pricing footer, contact@sencho.io in website footer.
1.1 KiB
1.1 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 0.2.x+ | Yes |
| < 0.2 | No |
Reporting a Vulnerability
Please do not open a public issue for security vulnerabilities.
You can report security issues in two ways:
- Email: Send details to security@sencho.io
- GitHub: Use private vulnerability reporting in the Security tab
In your report, include: steps to reproduce, impact assessment, and any suggested fixes.
You can expect an initial response within 72 hours. We will work with you to understand and address the issue before any public disclosure.
Security Considerations
Sencho manages Docker containers and has access to the Docker socket. When deploying:
- Always run behind a reverse proxy with TLS in production
- Use strong passwords and rotate JWT secrets
- Restrict network access to the Sencho port
- Review the security configuration docs for hardening guidance