Please do not disclose vulnerabilities in public issues, discussions, Discord channels, or social media.

Use a private GitHub security advisory instead:

https://github.com/LegacyAngel2K9/Pelican-DM/security/advisories/new

Include the affected version or commit, impact, reproduction steps, and a minimal proof of concept when possible. Do not include real credentials, private keys, access tokens, database exports, or data from production servers.

Until stable releases are published, security fixes are provided only for the latest commit on the default branch and the newest published release.

Pelican Deployment Manager stores infrastructure credentials and can execute privileged remote operations. Operators must:

• keep the external application.php configuration outside the repository and web root;
• restrict that file to the application user and back up its encryption key;
• use least-privileged database, Cloudflare, GitHub, Pelican, and SSH access;
• verify SSH host-key fingerprints through an independent channel;
• run the manager behind HTTPS and keep PHP, MariaDB, Composer dependencies, and the host operating system patched;
• review queued jobs and backups before approving production changes.

If a secret is exposed, rotate or revoke it immediately. Removing it from the latest commit does not remove it from Git history.