Security fixes target the latest release. Do not report credentials, private share URLs, or vulnerabilities in public issues.

Use the repository's Security → Report a vulnerability feature. Include the affected version, reproduction steps using synthetic data, and expected impact. If private reporting is unavailable, open an issue asking for a private contact without disclosing the vulnerability.

Deploy behind HTTPS. The gateway and its upstream are trusted infrastructure. Keep the data volume private: it contains share capabilities and page session authorization. Back it up securely.