root
bf71ba1b50
Add open-source scaffolding and CI; remove Claude-specific dev notes from the published tree. - Remove CLAUDE.md from tracking (kept locally, now git-ignored). - CHANGELOG.md (Keep a Changelog; v1.0 → v1.1.1). - SECURITY.md (private vuln reporting + operator guidance). - CONTRIBUTING.md (dev setup, conventions, PR flow). - .github/: bug + feature issue templates, PR template. - .github/workflows/ci.yml: byte-compile, validate example config, docker build. - .github/workflows/release.yml: on a version tag, publish a multi-arch (amd64 + arm64) image to GHCR. - README: license/release/CI badges, prebuilt-image (GHCR) run instructions, and a corrected Python-version note (3.9–3.11; netifaces caveat). Badges and image names use an `OWNER` placeholder to replace with the GitHub namespace after the repo is created. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1.1 KiB
1.1 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 1.1.x | ✅ |
| < 1.1 | ❌ |
Reporting a Vulnerability
Please do not open a public issue for security vulnerabilities.
Instead, use GitHub's private vulnerability reporting: Security → Report a vulnerability on the repository.
Include as much detail as you can:
- Affected version (see the version in the admin header or
GET /api/config) - Steps to reproduce / proof of concept
- Impact and any suggested remediation
You can expect an acknowledgement within a few days. Please allow reasonable time for a fix before any public disclosure.
Security Notes for Operators
ADS-Bit is intended for trusted LANs, not direct exposure to the public internet. If you must expose it:
- Set a strong admin password (changed from the setup default).
- Put it behind HTTPS via a reverse proxy or tunnel (e.g. Caddy, nginx, Tailscale). The built-in server speaks plain HTTP.
- Never commit your
config.json— it contains the admin password hash and session secret. It is git-ignored by default; fresh installs start fromconfig.json.example.