# Security Policy

PR Previews handles Gitea personal access tokens, AWS credentials, webhook
secrets, session cookies, SSH private keys, and live deployment logs. Treat
security issues as sensitive even when they appear limited to a local or
self-hosted deployment.

## Reporting a Vulnerability

Do not disclose suspected vulnerabilities publicly before they are reviewed.

Report issues through the private channel used by the project maintainers for
this repository. If you are running your own PP instance, report operational
incidents to that instance's administrator and rotate affected credentials.

Include:

- A short description of the issue and impact.
- Steps to reproduce, if safe to share.
- Affected versions, branches, or commit hashes.
- Whether any credentials, preview instances, repositories, or logs may have
  been exposed.

## Supported Versions

Security fixes are made on the active development branch and the current stable
deployment branch. Older branches are not guaranteed to receive fixes unless a
maintainer explicitly backports them.

## Sensitive Data Rules

- Never commit `.env`, database dumps, private keys, access tokens, session
  secrets, webhook secrets, or decrypted credential values.
- Never paste raw secrets into issues, pull requests, logs, screenshots, or PR
  preview comments.
- Rotate Gitea PATs, AWS access keys, webhook secrets, and `SESSION_SECRET` if
  exposure is suspected.
- Back up `ENCRYPTION_KEY` securely. Losing it makes stored credentials
  unreadable; exposing it can expose encrypted secrets if the database is also
  compromised.

## Security-Sensitive Areas

Review these areas carefully when changing behavior:

- `backend/src/lib/encryption.ts`
- `backend/src/lib/env.ts`
- `backend/src/lib/middlewares/auth.ts`
- `backend/src/routes/webhook.ts`
- `backend/src/services/deploy.ts`
- `backend/src/services/ec2.ts`
- `backend/src/services/gitea.ts`
- `backend/src/services/ssh.ts`

Preserve constant-time webhook signature checks, encrypted secrets at rest,
masked deploy logs, and API responses that avoid returning raw secrets.
