Security Policy & Vulnerability Disclosure

Security Commitment

Mostly Alive takes the security and integrity of our systems and content seriously. As an open-source static and edge-rendered application, our attack surface is minimal by design.

Reporting a Vulnerability

If you discover a security issue or vulnerability in our software, deployment configuration, or API endpoints:

1. Do not open a public GitHub issue.
2. Send a detailed report directly to security@nachtigall.dev or use GitHub Private Vulnerability Reporting on our repository.
3. Include reproducible steps, proof-of-concept payloads where appropriate, and potential impact analysis.

We commit to acknowledging your report within 48 hours and providing regular remediation updates until resolved.