d73fa6dcc9
Adds a security policy so vulnerability reports are routed to the private advisory form instead of public issues, and defines scope so the intentional no-auth LAN design is not re-reported as a vulnerability. Also adds a security contact link to the issue template chooser (blank issues are disabled, so there was previously no route for a private report), and extends .gitignore to cover .env variants, key/cert files, .npmrc/.netrc and local copies of the deployed compose file. A local management compose with real generated DB passwords was committed to a branch once before; secret scanning push protection now covers that case too. No tracked file is affected by the new ignore rules. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| scripts | ||
| workflows | ||
| dependabot.yaml | ||