# Security Policy

## Reporting a vulnerability

Do not open a public issue. Report vulnerabilities privately to the maintainer
at **contact.dvorak@gmail.com**. Include reproduction steps and the affected
component (API, auth service, frontend, or deployment).

You can expect an acknowledgement within a few days and a fix or mitigation
plan after triage.

## Scope notes

Primora is self-hosted software. Misconfiguration of your own deployment
(weak secrets, missing TLS, exposed ports) is a deployment concern, not a
project vulnerability — but hardening suggestions are welcome as normal
issues.

## Supported versions

The `main` branch only. Self-hosted deployments should rebuild regularly.