If you discover a security vulnerability in Databasement, please report it responsibly:
- Do not open a public GitHub issue for security vulnerabilities
- Use GitHub's private vulnerability reporting to submit the details (include steps to reproduce if possible)
- Allow reasonable time for a fix before public disclosure
We appreciate your help in keeping Databasement secure.
This policy applies to:
- The Databasement application code
- Official Docker images
- Official Helm charts
Third-party dependencies are managed through regular updates but are outside the direct scope of this policy.
Demo mode (DEMO_MODE) is also out of scope. It is off by default and exists only to run the public demo instance, where a shared account with known credentials that can download, delete and restore snapshots is intended. Enabling it on a real deployment is not a supported configuration.