安全修复只针对最新发布的次版本。

请通过 GIS-Info/web-git-graph 的 GitHub Security Advisories 私下报告漏洞。 不要在公开 issue 中附带仓库内容、凭据或未公开的补丁。

内置后端刻意做成只读，但它仍然会暴露仓库历史与源码补丁。请把它部署在你已有的 认证与授权之后。

• 在服务端用不透明 ID 注册仓库。
• 配置 allowedRoots。
• 不要直接从 URL 推导仓库路径。
• 除非允许的来源是明确的，否则保持 CORS 关闭。
• 每个请求都使用 authorize 钩子。
• 多实例部署时共享同一个 SnapshotStore。
• 及时更新 Git 可执行文件与本包。

后端从不调用 shell，也会拒绝任意 Git revision 表达式，但主机层面的访问策略仍然 是应用自身的责任。

Security fixes are provided for the latest published minor release.

Please report vulnerabilities privately through GitHub Security Advisories for GIS-Info/web-git-graph. Do not include repository contents, credentials, or private patches in a public issue.

The bundled backend is intentionally read-only, but it exposes repository history and source patches. Deploy it behind your existing authentication and authorization.

• Register repositories server-side with opaque IDs.
• Configure allowedRoots.
• Do not derive a repository path directly from a URL.
• Keep CORS disabled unless the allowed origin is explicit.
• Use the authorize hook for every request.
• Use a shared SnapshotStore in multi-instance deployments.
• Keep the Git executable and this package patched.

The backend never invokes a shell and rejects arbitrary Git revision expressions, but host-level access policy remains the application's responsibility.