Please do not report security vulnerabilities through public GitHub issues.

Instead, please create a private security advisory on GitHub.

When reporting a vulnerability, please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial response: Within 48 hours
• Status update: Within 7 days
• Fix timeline: Depends on severity (critical: ASAP, high: 30 days, medium: 90 days)

• We follow responsible disclosure practices
• We will coordinate with you on disclosure timing
• Credit will be given to reporters (unless anonymity is requested)

• Never commit connection strings with passwords to version control
• Use environment variables (PGMI_CONNECTION_STRING) for credentials
• For production, use Azure Entra ID, TLS client certificates (mTLS), or cloud IAM authentication

Secrets as parameters is supported and expected. The only banned path is the command line (--param key=secret leaks to ps, shell history, and CI logs). Use --params-file or a CI/CD-generated seeding file instead.

See docs/SECURITY.md for the full parameter security model, threat vectors, and CI/CD pipeline patterns.

• Template code (generated by pgmi init) is MIT-licensed and becomes your responsibility
• Review generated code before deploying to production
• Follow PostgreSQL security best practices (RLS, least privilege, etc.)

Contributors should:

• Never commit secrets, API keys, or credentials
• Use git-secrets or similar tools to prevent accidental commits
• Follow secure coding practices for SQL (parameterized queries, input validation)
• Report any security concerns immediately