This is a project template. Security fixes land on main; there are no long-term support branches. Always start new work from the latest main.

Please report security issues privately rather than opening a public issue.

• Preferred: open a private security advisory.
• Or email daniel.vu@mailbox.org with details and reproduction steps.

You can expect an acknowledgement within a few days. Please give a reasonable window to address the issue before any public disclosure.

When you generate a service from this template, review at minimum:

• SECRET_KEY_BASE and DATABASE_URL are supplied at runtime via environment / a pre-created Kubernetes Secret (existingSecret) — never committed.
• If you enable Erlang clustering, RELEASE_COOKIE is a shared credential: store it in a Kubernetes Secret and treat distribution ports as trusted only within the namespace.