mirror of
https://github.com/Dvorinka/Dash.git
synced 2026-10-28 07:41:27 +00:00
Tomas DvorakandDevin
a89a81d46c
README hero with real screenshots, install/config/widget docs, goreleaser for dash + dash-agent, GHCR release workflow, changelog, community files, agent systemd unit and Dockerfile, version stamping via -X main.version. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
35 lines
991 B
Markdown
35 lines
991 B
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
| Version | Supported |
|
|
|---|---|
|
|
| latest release | yes |
|
|
| older releases | no |
|
|
|
|
Dash is pre-1.0; only the latest release receives fixes.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Use GitHub's private vulnerability reporting:
|
|
**Security → Advisories → Report a vulnerability** on this repository.
|
|
|
|
Do not open a public issue for security problems.
|
|
|
|
Please include:
|
|
|
|
- affected version/commit
|
|
- steps to reproduce or a proof of concept
|
|
- impact assessment
|
|
|
|
You will get an acknowledgement within a few days. If the report is accepted,
|
|
a fix ships in the next release and you are credited in the advisory (unless
|
|
you prefer otherwise).
|
|
|
|
## Scope notes
|
|
|
|
Dash is designed for trusted private networks — it ships **without
|
|
authentication** by design. Exposure to the public internet is a deployment
|
|
choice outside the project's control, but issues that remain exploitable on a
|
|
LAN (SSRF in checkers, injection, token leakage, unsafe schemes) are in scope.
|