Security fixes are applied on the default branch (main). There is no long-term stable branch yet; please upgrade to the latest commit or release tag.

Please do not open a public GitHub issue for security problems.

Report privately via one of:

• GitHub Security Advisories for this repository (preferred when available)
• Email the maintainer listed in the GitHub profile for kkir/stomatopod

Include steps to reproduce, impact, and any suggested fix. You can expect an acknowledgement when the report is received; timelines depend on severity and maintainer availability.

• Self-hosted deployments must set a strong auth.secret_key, admin password, and STOMATOPOD_ADMIN_EMAIL; do not expose an unconfigured instance to the public internet.
• Optional MaxMind GeoLite databases are supplied by the operator; their license terms are separate from this project.