Security policy

Supported versions

Only the latest version on the default branch is supported. CCNA Tracker is deployed straight from it, so a fix lands for everyone as soon as it is merged.

What this project handles

CCNA Tracker has no backend, no accounts and no analytics. It stores nothing; the Python scripts only read files in this repo, and sync_anki.py talks to a local AnkiConnect on 127.0.0.1. Nothing you enter is sent to a server I run.

Reporting a vulnerability

Please don’t open a public issue for a security problem.

Go to the Security tab and click Report a vulnerability. That opens a private advisory only you and I can see.
Include what you found, how to reproduce it, and what an attacker could do with it.

I’ll acknowledge the report within 3 days, share a fix plan within 7 days, and credit you in the release notes unless you’d rather stay anonymous.

How this repo is protected

Dependabot checks dependencies and GitHub Actions every week and opens update PRs.
CodeQL scans the code on every pull request and once a week.
Secret scanning and push protection block committed API keys and tokens.
CI must pass before anything merges into the default branch.