# Security Policy

TinyWeb Forum is a trust-gated, gossip-based forum plugin. Moderation is
distributed — block lists can be manipulated by malicious peers.

## Supported Versions

Security fixes are handled on the default branch.

## Deployment Guidance

- Keep TinyWeb bound to `127.0.0.1` unless you need LAN access
- If binding to `0.0.0.0`, put a reverse proxy with auth in front (Caddy, nginx)
- Always use HTTPS when exposing beyond localhost
- Never commit `*.db`, `.env`, or `models/` to version control
- Forum trust is gossip-based: only subscribe to peers you trust

## Reporting

Report vulnerabilities privately by creating a confidential issue on the
repository. Do not file a public issue until the report has been acknowledged.