mirror of
https://github.com/Dvorinka/Dash.git
synced 2026-10-28 07:41:27 +00:00
Tomas DvorakandDevin
afa0c931b9
Restructure README to the standard OSS layout (logo, badges, screenshots grid, architecture, quick start). Add install.sh for curl|sh installs with a named-volume fallback for Docker Desktop file-sharing limits, and scripts/setup.sh for clone-based setup. Correct SECURITY.md (no longer pre-1.0) and CONTRIBUTING.md (auth shipped in 2.0.0). Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
35 lines
974 B
Markdown
35 lines
974 B
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
| Version | Supported |
|
|
|---|---|
|
|
| latest release | yes |
|
|
| older releases | no |
|
|
|
|
Only the latest release receives fixes.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Use GitHub's private vulnerability reporting:
|
|
**Security → Advisories → Report a vulnerability** on this repository.
|
|
|
|
Do not open a public issue for security problems.
|
|
|
|
Please include:
|
|
|
|
- affected version/commit
|
|
- steps to reproduce or a proof of concept
|
|
- impact assessment
|
|
|
|
You will get an acknowledgement within a few days. If the report is accepted,
|
|
a fix ships in the next release and you are credited in the advisory (unless
|
|
you prefer otherwise).
|
|
|
|
## Scope notes
|
|
|
|
Dash is designed for trusted private networks — it ships **without
|
|
authentication** by design. Exposure to the public internet is a deployment
|
|
choice outside the project's control, but issues that remain exploitable on a
|
|
LAN (SSRF in checkers, injection, token leakage, unsafe schemes) are in scope.
|