This repository documents and configures a private home network. It is not a product and has no users other than its owner, so "supported versions" does not really apply — main is the only branch that means anything, and it is what the lab runs.

What is useful here is a clear answer to two questions: what to do if you spot a problem, and what is already known.

If you find a misconfiguration, a leaked credential, or a weakness in what is published here, please report it privately rather than opening a public issue:

• GitHub Security Advisories — open a draft advisory (preferred; it stays private until fixed)
• Failing that, a GitHub issue without details, asking for a contact.

Please do not open a public issue containing a working credential, a capture, or anything that would let someone else reach the network before it can be fixed.

This is a personal project, so there is no SLA. Realistically: acknowledgement within a few days, and credential exposure treated as urgent.

The lab is a home network, not a bug bounty target. Scanning, probing or attempting to reach any host described in docs/network.md is unwelcome and not authorised. Everything worth reviewing is in this repository — review the configuration, not the running system.

Documented rather than quietly fixed, because a known and written-down exposure is a very different thing from an overlooked one. Full detail in docs/security.md.

Remediation is tracked in docs/roadmap.md, with procedures in docs/runbooks/rotate-snmp-community.md and docs/runbooks/purge-git-history.md.

.gitleaksignore enumerates all nine historical findings individually, with a note on each. It exists so the full-history scan stays meaningful — a job that is permanently red for a known reason gets ignored, and then a genuinely new leak goes unnoticed alongside it. It is an acknowledgement, not a fix, and it gets deleted once the purge has run.

Deliberate omissions, so their absence is not mistaken for an oversight:

• Full MAC addresses. Truncated to the vendor OUI, which keeps the useful half and drops the unique identifier.
• Owner-linked device names, and no room labelled as a child's.
• Camera-to-room mapping. That there are cameras is fine; which one covers which door is not.
• The WAN address, firewall rule bodies, and Wi-Fi configuration.
• Any plaintext credential. Secrets are SOPS + age encrypted; the private key never enters the repository. See secrets/README.md.

Every push and pull request runs:

• gitleaks over the working tree and full history, with rules for SNMP communities, inline Grafana passwords, PEM private keys and age secret keys.
• An assertion that every secrets/*.sops.yaml is genuinely encrypted, which needs no ability to decrypt.
• An assertion that no rendered or decrypted artefact — .env, .rendered/, .purge-secrets.txt — is ever a tracked file.
• Verification that every container image is pinned by tag and digest, so a moved tag cannot silently change what is deployed.

See docs/security.md for the threat model and segmentation rationale.