PocketLog stores personal financial data and is designed for private self-hosting. Security reports are taken seriously.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, use GitHub's private vulnerability reporting:

1. Open the Security tab of this repository.
2. Click "Report a vulnerability" to open a private security advisory.

This keeps the report confidential between you and the maintainer until a fix is available.

• A description of the vulnerability and its impact
• Steps to reproduce (proof of concept, affected version, configuration — SQLite vs. MariaDB, reverse proxy, auth path)
• Any suggested mitigation, if known

• Acknowledgement of your report as soon as possible.
• An assessment and, where applicable, a fix released as a new version (:X.Y.Z image tag).
• Coordinated disclosure — please allow a reasonable window before any public disclosure.

When sharing reproduction steps or logs, redact secrets (session/CSRF tokens, API keys, password hashes, cookies) and use throwaway accounts — never real financial data.

Security fixes are provided for the latest released version only. Always run the most recent :X.Y.Z image tag.