# Security Policy

Thank you for helping keep Doktainer and its users secure.

## Supported Versions

The following versions currently receive security updates:

| Version                    | Supported |
| -------------------------- | --------- |
| Latest Milestone Release   | ✅        |
| Previous Milestone Release | ✅        |
| Older Releases             | ❌        |

As Doktainer is currently in the pre-1.0 phase, users are encouraged to always upgrade to the latest available release.

## Reporting a Vulnerability

If you discover a security vulnerability, please do **not** create a public GitHub Issue.

Instead, report the vulnerability privately through:

- GitHub Security Advisories (preferred)
- GitHub Private Vulnerability Reporting

Please include:

- A description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested mitigation (if available)

## Response Process

After receiving a report, the Doktainer maintainers will:

1. Acknowledge receipt of the report.
2. Investigate and validate the issue.
3. Develop and test a fix.
4. Release a security update if necessary.
5. Publicly disclose the vulnerability after a fix is available.

## Scope

Examples of security vulnerabilities include:

- Authentication bypass
- Privilege escalation
- Remote code execution
- Command injection
- Server-side request forgery (SSRF)
- Sensitive information disclosure
- Container escape vulnerabilities
- Insecure secret handling

## Disclosure Policy

Please allow maintainers a reasonable amount of time to investigate and address reported vulnerabilities before publicly disclosing them.

Responsible disclosure helps protect Doktainer users and infrastructure operators.

## Security Updates

Security fixes may be released as maintenance releases:

- v0.x.1
- v0.x.2
- v0.x.3

or, when necessary, included in the next milestone release.

## Acknowledgements

We appreciate responsible security researchers and community members who help improve the security of Doktainer.