Do not disclose a vulnerability, secret, or user data in a public issue, discussion, or pull request. Use GitHub Private Vulnerability Reporting in the repository's Security tab.
Include:
- the affected version or commit;
- the component and relevant configuration;
- minimal reproduction steps using synthetic data;
- the expected impact;
- a suggested mitigation, if known.
Do not attach real tokens, database exports, chat transcripts, health records, or unredacted logs. Maintainers will acknowledge the private report and coordinate remediation and disclosure in that thread.
There is no supported stable version before the first public release. The development branch may contain incomplete migrations and must not be treated as a production security boundary.
After the first release, this table will list the maintained release lines:
| Version | Supported |
|---|---|
| Pre-release development builds | No security support guarantee |
The first public release is blocked until this table names the exact maintained
release line and SUPPORT.md states its support window, as required by the
public release checklist.
The policy covers the backend, official clients, container definitions, device pairing, profile authorization, release artifacts, and Dante-owned integration extensions.
Administrators remain responsible for:
- terminating TLS and restricting network access;
- protecting
.env, backups, and mounted credentials; - revoking lost devices and reviewing their profile grants;
- installing updates and verifying successful backups;
- securing third-party services such as push, calendar, and AI providers.
Dante binds to loopback by default. Do not bind it to a public interface without an authenticated TLS reverse proxy and an explicit risk review.