# Security Policy

## Reporting a Vulnerability

Please report security issues to contact@projectsend.org

Please do not open a public issue for security reports.

Thanks!

## Securing your own installation

If you are looking for how to configure and verify a deployment rather than
report a bug, see [SECURITY_HARDENING.md](SECURITY_HARDENING.md). It covers the
web server rules that keep uploaded files private on Nginx and Apache, how to
check they are actually working, encryption key handling, and the
authentication options worth turning on.
