1.5 KiB
Security policy
Security fixes target the latest release. Older releases have no guaranteed backport support. Upgrade before verifying whether an issue is still present.
Do not publish credentials, private photos, production logs, or working exploit payloads in public issues. Contact the repository owner privately through the hosting platform when available. If no private contact channel is available, open an issue asking for a confidential reporting channel without technical vulnerability details. There is currently no dedicated security mailbox or promised response SLA.
A useful private report includes the affected version, deployment mode, required permissions, impact, and minimal steps using mock data. Do not test on another person's deployment or write to real frames without explicit authorization.
当前容器映像检查
v0.1.23 使用官方 Python Alpine 3.24 基础映像并固定摘要，构建时应用 APK 安全更新。2026-10-18 使用 Trivy 0.76.0 扫描与当前生产运行 ID 一致的 Linux AMD64 映像，涵盖操作系统和 Python 包、全部严重级别，未检出已知漏洞；未配置漏洞忽略规则。该结果是当日漏洞库快照，不是未来无漏洞的保证，也不代表旧运行容器已升级。
基础映像更新后须重新构建并复扫。默认非 root、只读根目录、清空 capabilities 和 no-new-privileges 的部署限制继续保留。中文字体、第三方许可证和依赖元数据均保留；不以删除包清单掩盖告警。