Security Policy
Security foundations, vulnerability reporting, and best practices.
Our Commitment to Security
As a sovereign self-hosted Git platform and ephemeral PaaS, security is at the core of mag's design. We isolate deployments using WireGuard private virtual networks, restrict database/redis connections to local/VPN interfaces, and enforce token-based secure authentication.
Report a Vulnerability
If you discover any security vulnerability, please do not disclose it publicly. You can report it directly by contacting support or opening a private issue in the main repository. We will investigate all reports promptly and coordinate a fix.
Security Best Practices
- Keep your Personal Access Tokens (PAT) private and rotate them regularly.
- Verify that your SSH public keys are correctly configured and remove any unused keys.
- Ensure your private deployments are properly restricted to authorized collaborators and VPN connections.