Email hello@notice.cx with a private report. Include the affected version or commit, steps to reproduce, and the impact. Redact credentials and personal data from examples and logs.

Keep vulnerability details out of public issues and pull requests until a fix or disclosure plan is agreed with the maintainers.

The standalone installation has no login: anyone who can reach it can read and change its data. Keep it behind an access proxy, VPN or private network; do not expose it directly to the internet. The Docker demo preview has a separate, fixed read-only profile for synthetic data. It requires an HTTPS reverse proxy and does not publish its database ports. Do not place customer data or provider credentials in that deployment. Customer account hosting is not part of the preview release.

See the release and upgrade policy for supported installation paths, verification and database maintenance.