Please do not open a public issue for security problems. Email the maintainer directly, or open a private advisory via GitHub's security advisory flow.

Please include:

• A short description of the issue and its impact
• Steps to reproduce
• Affected version(s) / commit(s)
• Any suggested fix, if you have one

You'll get an acknowledgement within 48 hours and a fix plan as soon as possible after that. Thanks for helping keep this project safe.

• Trusted network default. The web UI is designed for LAN / VPN use (Tailscale, WireGuard). Do not expose it to the public internet without adding authentication in front.
• Optional token auth. Setting SCANNER_AUTH_TOKEN requires every request (except /ping and /health) to present x-scanner-token or Authorization: Bearer <token>.
• Secret-path filtering. Local-directory ingestion excludes credential material: .ssh, .aws, .gnupg, .config, .kube, .docker, secrets/, credentials/, .env*, *.pem, *.key, *.p12, *.pfx, *.crt, *.kdbx, id_rsa/id_ed25519/etc., .npmrc, .pypirc, .netrc, and .git-credentials.
• No secrets in the repo. API keys arrive via environment variables or an untracked env file. config.json, scanner.log, and pending/ are gitignored.
• Path allow-listing. /graph refuses / and paths under the git mirror server's own directory.