Security Policy
Supported Versions
This repository is actively maintained. Security fixes are applied to the latest version on main.
| Version | Supported |
|---|---|
| latest (main) | ✅ |
| older branches | ❌ |
Reporting a Vulnerability
Do not open a public GitHub issue for security vulnerabilities.
Please report security issues privately to:
- Email: info@eliaslenz-mbaberatung.de
- Subject line:
[SECURITY] <repo-name> — <brief description> - Response time: Within 72 hours
Include in your report:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if known)
Security Standards
This repository follows:
- DevSecOps principles
- BSI IT-Grundschutz (applicable Bausteine)
- OWASP Secure Coding Practices
- Secure by Design — security controls are built in, not bolted on
Security Controls in This Repo
- Branch protection on
main— PRs required, no direct pushes - Dependabot enabled for automated dependency vulnerability alerts
- Secret scanning enabled
- All CI/CD workflows are session-gated (
workflow_dispatch— no autonomous scheduled runs) - Pre-commit hooks: secret detection, YAML/JSON lint
Disclosure Policy
We follow responsible disclosure. Reporters who identify valid vulnerabilities will be acknowledged (unless anonymity is requested).