envferry handles developer secrets, so security reports are welcome. Please do not file exploit details as public issues.

Until 1.0.0, security fixes target the latest released version and main.

Use GitHub private vulnerability reporting. Do not include real secrets in a report — reproduce with dummy values.

Helpful reports include:

• The affected command or API.
• A minimal reproduction using dummy values.
• Whether plaintext secrets can be exposed, overwritten, or sent to the wrong destination.

In scope:

• Plaintext secret disclosure over any transport.
• A relay that can read, tamper with, or misroute a payload it is meant to forward blindly.
• Path traversal or unsafe receive-target behavior.
• Dependency or release-process compromise.
• Downgrade or forward-secrecy weaknesses in the TLS-PSK handshake.

Out of scope:

• The loopback transport (local-…), documented as unencrypted and same-machine only.
• Denial of service against a self-hosted relay from an unauthenticated client: the built-in caps raise the bar, but operators are expected to firewall or rate-limit a public relay (see docs/operating-a-relay.md).

See docs/threat-model.md for the full model.