This repo provides Docker Compose definitions for local development services only. They are intentionally not hardened for production use: fixed, publicly-documented default credentials (e.g. devuser / devpassword), no TLS, no auth hardening. That is by design, not a vulnerability — please don't report it as one.

Things that are in scope for a report:

• A service bound to something other than localhost by default in a way that could expose it on a shared network without the developer opting in.
• A dependency/image pinned to a version with a known, fixed CVE where bumping the pin is straightforward.
• A committed file that contains a real secret, credential, or token (as opposed to a documented local-dev-only default).
• A supply-chain concern: a service pulling from an untrusted or typosquatted image source, or a script that fetches and executes remote code without review.
• A flaw in the orchestration tooling (Makefile, scripts/services.sh) that could lead to unintended data loss or unintended exposure.

Please do not open a public GitHub issue for a security report.

Preferred: use GitHub's private vulnerability reporting for this repository (Security tab → "Report a vulnerability").

Alternative: email emmadonjo@gmail.com with a description of the issue, steps to reproduce, and its potential impact.

We'll acknowledge reports within a few days and aim to have a fix or mitigation plan within two weeks, depending on severity. Credit is given in the fix's release notes unless you'd prefer to stay anonymous.

This is a rolling catalog of local-dev tooling, not a versioned release artifact — only the latest state of the default branch is supported.