tinyweb-forum/SECURITY.md

Security Policy

TinyWeb Forum is a trust-gated, gossip-based forum plugin. Moderation is distributed — block lists can be manipulated by malicious peers.

Supported Versions

Security fixes are handled on the default branch.

Deployment Guidance

• Keep TinyWeb bound to 127.0.0.1 unless you need LAN access
• If binding to 0.0.0.0, put a reverse proxy with auth in front (Caddy, nginx)
• Always use HTTPS when exposing beyond localhost
• Never commit *.db, .env, or models/ to version control
• Forum trust is gossip-based: only subscribe to peers you trust

Reporting

Report vulnerabilities privately by creating a confidential issue on the repository. Do not file a public issue until the report has been acknowledged.