xinjian0101
0abad8bdb1
Upgrade the public project homepage, document the bilingual interface model, and add repository contribution, security, issue, and pull request guidance.
27 lines
968 B
Markdown
27 lines
968 B
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
| Version | Status |
|
|
|---|---|
|
|
| 0.8.x | Preview development |
|
|
| 0.7.x | Maintained |
|
|
| Earlier | Not maintained |
|
|
|
|
## Reporting a security issue
|
|
|
|
Please use GitHub private vulnerability reporting when available. Do not include secrets, personal information, or production data in a report.
|
|
|
|
Provide the affected version, reproduction steps, observed behavior, expected behavior, and a minimal test case.
|
|
|
|
## Project security principles
|
|
|
|
- Project bundles must not contain API keys or credentials.
|
|
- Imported manifests must be validated before use.
|
|
- External JSON must remain declarative data.
|
|
- File operations must remain inside approved project directories.
|
|
- Audit-chain and revision checks must fail safely.
|
|
- Stale edit locks and malformed worker registrations must be rejected.
|
|
|
|
External models, operating systems, FFmpeg builds, ComfyUI installations, and third-party custom nodes have their own security boundaries.
|