Full security documentation: docs/en/SECURITY.md | Español

Do not report security vulnerabilities through public GitHub issues.

Use one of these private channels:

1. GitHub Security Advisories (Preferred)

   • Navigate to the repository Security tab
   • Click "Report a vulnerability"
   • Fill out the private vulnerability report form

2. Email

   • Send to: sergio.canales.e@gmail.com
   • Subject: HOMEDIR SECURITY: <short description>
   • Include: affected version, environment, impact, reproduction steps

• Acknowledgement: Within 48 hours
• Initial assessment: Within 5 business days
• Status updates: At least weekly until resolution

We support only the current major version. Previous majors become unsupported (EOL) immediately upon new major release.

Current active major: 3.x

• Authentication: OAuth2/OIDC (GitHub, Discord, Google)
• Authorization: Role-based access control (RBAC)
• Secret Scanning: Pre-commit hooks with gitleaks
• Dependency Scanning: Automated Dependabot alerts
• HTTPS: Enforced in production
• Input Validation: Server-side validation
• CSRF Protection: Built-in Quarkus protection

We support good-faith security research that:

• Avoids privacy violations and data destruction
• Uses only your own accounts/data
• Reports vulnerabilities promptly
• Keeps details confidential until fix is released

We will not pursue legal action against researchers following these guidelines.

• Full Security Policy: docs/en/SECURITY.md
• Security Hardening Guide: docs/en/development/security-hardening-baseline.md
• Endpoint Authorization Matrix: docs/security/endpoint-authorization-matrix.yaml
• Secret Scanning Setup: docs/guides/pre-commit-secret-scanning.md
• Supply Chain Security: docs/en/features/supply-chain-security.md

• Vulnerability Reports: Use GitHub Security Advisories (preferred) or sergio.canales.e@gmail.com
• General Security Questions: GitHub Discussions - Security

Last Updated: June 2026