Security
Report a security issue.
Security reports should reach the people who can investigate them without exposing users or unpatched instances.
Reporting channel
The permanent security mailbox and encryption details will be published before the flagship accepts outside production use. Until then, do not post suspected vulnerabilities in a public Pipoca conversation.
The standard machine-readable location is /.well-known/security.txt.
What a useful report includes
- The affected version, image digest, and deployment type.
- A minimal reproduction that does not contain other people’s data.
- The expected and observed security boundaries.
- Whether the issue has been disclosed anywhere else.
Independent servers
Each self-hosted operator controls its own deployment. Product vulnerabilities belong with Picolé Co.; compromised infrastructure and local configuration remain the operator’s incident-response responsibility.