If you find a security issue in this template, please report it privately via GitHub's Security Advisories feature rather than opening a public issue. We aim to acknowledge reports within 3 business days.

This is a template repository — vulnerabilities in the architecture, dependency defaults, generated Docker image, or CI configuration are in scope. Vulnerabilities in your own downstream application built from this template are not.

Only the main branch receives security fixes.

1. Acknowledgement within 3 business days.
2. A fix or mitigation plan communicated back to you.
3. Credit in the release notes, unless you prefer to stay anonymous.