root
bf71ba1b50
Add open-source scaffolding and CI; remove Claude-specific dev notes from the published tree. - Remove CLAUDE.md from tracking (kept locally, now git-ignored). - CHANGELOG.md (Keep a Changelog; v1.0 → v1.1.1). - SECURITY.md (private vuln reporting + operator guidance). - CONTRIBUTING.md (dev setup, conventions, PR flow). - .github/: bug + feature issue templates, PR template. - .github/workflows/ci.yml: byte-compile, validate example config, docker build. - .github/workflows/release.yml: on a version tag, publish a multi-arch (amd64 + arm64) image to GHCR. - README: license/release/CI badges, prebuilt-image (GHCR) run instructions, and a corrected Python-version note (3.9–3.11; netifaces caveat). Badges and image names use an `OWNER` placeholder to replace with the GitHub namespace after the repo is created. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
36 lines
1.1 KiB
Markdown
36 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| 1.1.x | ✅ |
|
|
| < 1.1 | ❌ |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please **do not** open a public issue for security vulnerabilities.
|
|
|
|
Instead, use GitHub's private vulnerability reporting:
|
|
**Security → Report a vulnerability** on the repository.
|
|
|
|
Include as much detail as you can:
|
|
- Affected version (see the version in the admin header or `GET /api/config`)
|
|
- Steps to reproduce / proof of concept
|
|
- Impact and any suggested remediation
|
|
|
|
You can expect an acknowledgement within a few days. Please allow reasonable
|
|
time for a fix before any public disclosure.
|
|
|
|
## Security Notes for Operators
|
|
|
|
ADS-Bit is intended for trusted LANs, not direct exposure to the public
|
|
internet. If you must expose it:
|
|
|
|
- Set a strong admin password (changed from the setup default).
|
|
- Put it behind HTTPS via a reverse proxy or tunnel (e.g. Caddy, nginx,
|
|
Tailscale). The built-in server speaks plain HTTP.
|
|
- Never commit your `config.json` — it contains the admin password hash and
|
|
session secret. It is git-ignored by default; fresh installs start from
|
|
`config.json.example`.
|