SECURITY.md

Security Policy

Supported Versions

We support the latest published release of ZenNotes. Security fixes land on main first and roll into the next release.

Reporting a Vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

Report issues privately through GitHub's private vulnerability reporting form for this repository. Include:

• A description of the issue and the impact
• Steps to reproduce or a proof of concept
• Affected versions, if known
• Any suggested remediation

We aim to acknowledge reports within 3 business days and to ship a fix or publish a coordinated advisory within 30 days of confirmation.

Security Documentation

For the current product security model and deployment guidance, read:

• docs/how-to/secure-self-hosting.md
• docs/how-to/at-rest-encryption.md
• docs/reference/security-reference.md
• docs/explanation/security-model.md