> For the complete documentation index, see [llms.txt](https://summerain-1.gitbook.io/summerain/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://summerain-1.gitbook.io/summerain/community/security.md).

# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability, **do not open a public issue**.

Report it privately through [GitHub Security Advisories](https://github.com/kserksi/summerain/security/advisories/new). We will acknowledge the report and assess its impact as soon as possible.

Please include as much of the following information as possible:

* A clear description of the issue and its impact
* Reproduction steps, preferably with a minimal reproducible example
* Affected versions
* A suggested remediation, if available

## Response Process

1. We acknowledge the report within 72 hours.
2. We assess the severity and verify the vulnerability.
3. We develop a fix, using a private branch when warranted by the severity.
4. We publish a corrected release and credit the reporter publicly with their consent.

## Supported Versions

Only the latest release on the `main` branch receives security fixes. Older versions do not receive separate security patches.

## Deployment Security

See [docs/USAGE.md](/summerain/user-and-operations/usage.md) for the complete guidance. Key requirements include:

* Set strong, random values for `COOKIE_SECRET`, `IMGPROXY_KEY`, and `IMGPROXY_SALT` in production.
* Cookies with the `__Host-` prefix require HTTPS and a same-origin deployment. Local development must use a self-signed certificate.
* Keep the MySQL, Redis, and imgproxy containers on the private network without exposing their ports publicly.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://summerain-1.gitbook.io/summerain/community/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.