22 lines
1.5 KiB
Markdown
22 lines
1.5 KiB
Markdown
# Security policy
|
|
|
|
Security fixes target the latest release. Older releases have no guaranteed
|
|
backport support. Upgrade before verifying whether an issue is still present.
|
|
|
|
Do not publish credentials, private photos, production logs, or working exploit
|
|
payloads in public issues. Contact the repository owner privately through the
|
|
hosting platform when available. If no private contact channel is available,
|
|
open an issue asking for a confidential reporting channel without technical
|
|
vulnerability details. There is currently no dedicated security mailbox or
|
|
promised response SLA.
|
|
|
|
A useful private report includes the affected version, deployment mode, required
|
|
permissions, impact, and minimal steps using mock data. Do not test on another
|
|
person's deployment or write to real frames without explicit authorization.
|
|
|
|
## 当前容器映像检查
|
|
|
|
v0.1.21 使用官方 Python Alpine 3.24 基础映像并固定摘要，构建时应用 APK 安全更新。2026-10-18 使用 Trivy 0.76.0 扫描构建的 Linux AMD64 映像，涵盖操作系统和 Python 包、全部严重级别，未检出已知漏洞；未配置漏洞忽略规则。该结果是当日漏洞库快照，不是未来无漏洞的保证，也不代表旧运行容器已升级。
|
|
|
|
基础映像更新后须重新构建并复扫。默认非 root、只读根目录、清空 capabilities 和 no-new-privileges 的部署限制继续保留。中文字体、第三方许可证和依赖元数据均保留；不以删除包清单掩盖告警。
|