NEXORA is a self-hosted application. Operators are responsible for protecting the host, database, environment files, backups, SMTP credentials, and network boundary.
Please do not report suspected vulnerabilities in a public issue or pull request. Once private vulnerability reporting is enabled for the GitHub repository, use its Report a vulnerability flow. Until then, contact the maintainer through a verified private channel and do not include exploit details in a public forum.
Include the affected version or commit, impact, prerequisites, and a reproducible description. Redact credentials, session cookies, invitation or verification tokens, and personal data. The maintainer may request additional details or a coordinated disclosure timeline.
| Version | Supported |
|---|---|
| 0.2.x (preview) | Yes |
| 0.1.x (preview) | No |
| main | Yes |
Security fixes land on main and in the next 0.2.x release. Include the
version, commit, or container image tag in your report.
- Keep
deploy/runtime.envprivate and out of source control. - Use unique production credentials and restrict access to the host and backups.
- Use the production Compose file with HTTPS and a trusted SMTP service; do not expose PostgreSQL, the API, or Mailpit directly.
- Keep registration invite-only unless public signup is an explicit policy.
- Back up PostgreSQL before upgrades and review migrations before deployment.
- Review DEPLOYMENT.md for proxy trust, bootstrap, upgrades, and backup procedures.
Security checks and penetration tests are bounded evidence, not a guarantee that NEXORA is free of vulnerabilities.