If you discover a security vulnerability in Vaulx, please report it responsibly.
Do NOT open a public GitHub issue for security vulnerabilities.
Instead, email us at: security@yavlabs.com
Include:
- Description of the vulnerability
- Steps to reproduce
- Impact assessment
- Suggested fix (if any)
We will acknowledge your report within 48 hours and provide a timeline for a fix.
| Version | Supported |
|---|---|
| 1.x | Yes |
When deploying Vaulx:
- Always use HTTPS (TLS) in production
- Set strong, unique values for
JWT_SECRET,JWT_REFRESH_SECRET, andSERVER_ENCRYPTION_KEY - Use a dedicated PostgreSQL user with minimal privileges
- Keep Docker images and dependencies up to date
- Enable audit logging and review logs regularly
- Configure SSO with enforced MFA where possible
- Restrict network access to MinIO, Redis, and PostgreSQL (internal network only)