Security fixes land on main and are released as 1.0.x patch versions.

Please do not open a public issue for suspected security vulnerabilities.

Instead, use GitHub's private reporting: Report a vulnerability

Include:

• Affected component (ingestion, API, auth, frontend, deployment)
• Steps to reproduce or a proof of concept
• Impact (e.g. auth bypass, data exposure, injection, RCE)

We'll acknowledge reports and follow up with a fix timeline. Since Vestigo is designed for airgapped/offline forensic environments, issues around unintended network egress (violations of VESTIGO_ALLOW_ONLINE) are treated as security-relevant, not just bugs.

In scope: the application itself (src/vestigo/, frontend/), its authentication/RBAC/audit layer, and the reference docker-compose.yml deployment. Out of scope: vulnerabilities in third-party dependencies (PostgreSQL, ClickHouse, Qdrant) — report those upstream; Dependabot tracks known CVEs in this repo's dependency graph.

A dependency advisory that does not apply to Vestigo — because the affected code path is unreachable in this application, or because no fixed version has been published yet — is recorded with that reasoning and a revisit trigger under "standing decisions" in docs/ROADMAP.md, never silently ignored.