Security
Security
Report a vulnerability in this software or this instance to [email protected]. Operator mail also reaches [email protected]. Please include enough detail to reproduce the issue and do not attach live secrets.
Keep the master key apart from database backups. Use HTTPS in front of any non-loopback bind. Registration can be closed with KONEKTOR_ALLOW_REGISTRATION=false. Authenticator codes can be required from Settings.
A machine-readable contact file is published at /.well-known/security.txt.
Last updated 15 November 2026.