From decefb89d51a88d17142dbb64764c6c880b77598 Mon Sep 17 00:00:00 2001 From: blankie Date: Fri, 3 Jul 2026 02:22:56 +0000 Subject: [PATCH] security: replace personal email with confidential issue reporting --- SECURITY.md | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index f294f81..87b4df4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1 +1,21 @@ -If you find a security issue, report it privately by emailing blankie@tuta.com. Please don't file a public issue. +# Security Policy + +TinyWeb Forum is a trust-gated, gossip-based forum plugin. Moderation is +distributed — block lists can be manipulated by malicious peers. + +## Supported Versions + +Security fixes are handled on the default branch. + +## Deployment Guidance + +- Keep TinyWeb bound to `127.0.0.1` unless you need LAN access +- If binding to `0.0.0.0`, put a reverse proxy with auth in front (Caddy, nginx) +- Always use HTTPS when exposing beyond localhost +- Never commit `*.db`, `.env`, or `models/` to version control +- Forum trust is gossip-based: only subscribe to peers you trust + +## Reporting + +Report vulnerabilities privately by creating a confidential issue on the +repository. Do not file a public issue until the report has been acknowledged.