This repository is infrastructure-as-code for a live, single-environment homelab, not a versioned software package - there are no release tags or maintained branches other than main. main always reflects the currently-deployed configuration and is the only branch that receives security fixes.

Please do not open a public GitHub issue for a security vulnerability. Publicly disclosing a weakness in a live, internet-facing homelab before it's fixed could expose it to real exploitation.

Instead, please report it privately using GitHub Security Advisories ("Report a vulnerability" under this repository's Security tab). This opens a private discussion with the maintainer and lets you receive credit once a fix is published, without the report being visible to the public in the meantime.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce, or the specific manifest/configuration involved
• Any suggested remediation, if you have one

This is a personal project maintained by one person outside of working hours, so response times aren't guaranteed - but security reports are treated as a priority over other issues and pull requests. You'll get an acknowledgement as soon as the report is seen, and updates as the issue is investigated and (if applicable) fixed.

Most of what this repository describes runs behind a firewalled home network and is not directly reachable from the internet except through the specific domains listed in docs/01-setup-and-runbook.md. Reports about the actual configuration in this repo (Terraform, Ansible, Kubernetes manifests, CI workflows) are in scope. Reports about third-party software this repo merely deploys (Kubernetes itself, Longhorn, cert-manager, etc.) are best reported upstream to those projects directly, though you're welcome to flag them here too if you're not sure where they belong.