v1.0.0 is the first production release. Supported versions:

• The latest stable major (v1.x) - all security fixes.
• The previous stable major - security fixes only, for 6 months after a new major ships.

Run a current v1.x release in production; older tags receive best-effort fixes only.

Do not open public GitHub issues for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting: navigate to the repository's Security tab → Report a vulnerability. This sends an encrypted report directly to the maintainers and creates a private draft advisory.

If private reporting is unavailable, email the lead maintainer (contact published on the project website / GitHub profile) with [SECURITY] in the subject line. There is no published PGP key at the moment; use GitHub's private reporting if the report is sensitive enough to need encryption in transit.

• A description of the vulnerability and its impact.
• Steps to reproduce, including:
  • Versions affected (commit hash, release tag).
  • Configuration relevant to the issue.
  • Whether authentication is required to trigger it.
• Any proof-of-concept code (please do not test against systems you don't own).
• Your name / handle for credit (or "anonymous").

• Acknowledgement within 72 hours.
• Initial triage (severity assessment, scope confirmation) within 7 days.
• Fix or mitigation target depends on severity:
  • Critical (RCE, auth bypass, data loss): 7 days.
  • High (privilege escalation, sensitive data exposure): 14 days.
  • Medium / Low: 30–60 days.
• Public disclosure after a fix is released, with credit unless requested otherwise. We follow a 90-day disclosure window from initial report; extensions discussed case-by-case.

In scope:

• This repository and all artifacts it produces (the container images on ghcr.io/powerdns-authadmin/powerdns-authadmin and the signed release assets).
• Configuration recommendations in docs/.

Out of scope:

• PowerDNS itself (please report to https://www.powerdns.com/security).
• Third-party dependencies (please report upstream, but feel free to CC us if it affects our users).
• Social engineering of maintainers or users.

PowerDNS-AuthAdmin ships secure defaults, but deployment hardening is the operator's responsibility. docs/08-HARDENING.md is the checklist (TLS termination, secret storage, network exposure, MFA, image-signature verification); docs/FEATURES.md § 17 lists the built-in security posture.

Researchers who responsibly disclose a vulnerability are credited in the GitHub security advisory and in the CHANGELOG.md entry for the fix. By default we credit reporters; you may opt out at report time.

We do not currently offer a monetary bug bounty. We do offer profuse thanks.