# Security Policy

`mgf-cloud-web` is a federation sibling of [`mgf-common`](https://codeberg.org/magogi-admin/mgf-common)
and a thin web front-end over [`mgf-cloud`](https://codeberg.org/magogi-admin/mgf-cloud).
It drives **live, billable infrastructure** and runs against **cloud
credentials** (resolved by `mgf-cloud`), so we take security reports seriously.

## Scope

`mgf-cloud-web` is a **local, single-user** console: it binds `127.0.0.1`, has no
authentication, and is meant to run on an operator's own machine. It is **not** a
hosted, internet-facing, or multi-user service, and must not be deployed as one
without an auth/hardening layer that does not yet exist here.

## Supported versions

In the 0.x window, **only the latest MINOR receives security patches** (per
[SemVer 0.x](https://semver.org/#spec-item-4) and rule **AP-03**). Security
fixes ship as the next PATCH on the latest MINOR.

| Version | Supported |
|---------|-----------|
| `0.1.x` | ✅ — latest MINOR; security patches ship as `0.1.Y` |
| `< 0.1` | ❌ — pre-publish development; upgrade to `0.1.x` |

## A note on credentials

Credential resolution is delegated to `mgf-cloud` — a `clouds.yaml` file, the
`OS_*` environment, or a clouds file under `my_stuff/` (gitignored per AG-18).
Credentials are **never logged**, never serialised into errors, and **never
surfaced in the web GUI**. Outbound TLS verification stays on.

## Reporting a vulnerability

**Please do not open a public issue or pull request** until we have had a chance
to respond. Email the maintainer (see the Codeberg profile for
`magogi-admin`) with a description, reproduction, and impact.
