Security

SECURITY.md

Security Policy

Supported Versions

Version	Supported
Latest	Yes
Older	No

Only the latest release is supported with security updates.

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

Do NOT open a public GitHub issue.
Email the maintainers at security@tibco.com with:
- A description of the vulnerability
- Steps to reproduce
- Potential impact
You will receive an acknowledgment within 5 business days.
A fix will be developed privately and released as soon as possible.

Security Best Practices for Deployers

Always set a unique SESSION_SECRET environment variable in production.
Keep dependencies up to date and run npm audit regularly.
Use HTTPS in production deployments.
Restrict Kubernetes RBAC permissions to the minimum required.

There aren't any published security advisories