# Security policy

Do not open a public issue containing a client secret, bridge URL, access token,
private key, `.env` file, Docker volume export or Portainer backup.

If sensitive data is exposed, revoke or rotate it first. Then contact the
repository owner through a private Gitea channel and include only the minimum
information needed to reproduce the problem.

Before publishing a change, run:

```sh
./scripts/audit-public.sh
```

The audit covers the current tree and every locally reachable Git commit. It is
a guardrail, not a substitute for reviewing the diff and generated artifacts.