hochu-sdelat-mini-servis-po/SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in this project, please report it responsibly.

Do NOT open a public GitHub issue.

Instead, send an email to: admin@everything.kz

Please include:

• A description of the vulnerability.
• Steps to reproduce the issue.
• Any relevant logs or screenshots.

We will acknowledge your report within 48 hours and aim to provide a fix or mitigation within 7 days.

Supported Versions

Version	Supported
1.x	✅

Security Best Practices

• Never commit .env, keypair.json, device.json, or *.bak files.
• Always set TOKEN_SECRET_KEY via environment variable — the app will refuse to start without it.
• Rotate keys periodically using npm run regen:keypair and npm run regen:device.
• Keep dependencies up to date (npm audit).