Please report security issues privately through GitHub's private vulnerability reporting for this repository. Do not open a public issue.

You should get an acknowledgement within three days. Fixes for the current minor release are published as a patch release with a security note in the changelog; reporters are credited unless they ask not to be.

In scope: anything that lets a hosted site, an agent process or a non-owner operator do more than the trust model allows (docs/TRUST.md), secrets exposed where docs/SECURITY.md says they are not, and the installer or helper writing outside the paths it documents.

Out of scope: issues that require already having root on a managed server or owner access to the panel, and the documented sharing of the kernel, Postgres instance and loopback between hosted sites.