Security

SECURITY.md

Security Policy

LoveReader is intended for self-hosted personal use. Please do not expose a default-password installation to the public internet.

Supported Versions

Security fixes are expected to target the latest main branch.

Reporting a Vulnerability

If you find a vulnerability, please open a private security advisory on GitHub when available, or contact the maintainer privately.

Please include:

A clear description of the issue.
Reproduction steps.
Expected impact.
Suggested mitigation, if known.

Deployment Checklist

Change ADMIN_PASSWORD before deployment.
Use a strong random JWT_SECRET.
Keep production .env files out of git.
Put LoveReader behind HTTPS if accessed remotely.
Back up the SQLite database and upload directory.

There aren't any published security advisories