# Security Policy
## Supported Versions
| Version | Supported |
| ------- | ------------------ |
| latest | :white_check_mark: |
| < 1.0 | :x: |
## Reporting a Vulnerability
We take security seriously. If you discover a security vulnerability, please follow these steps:
1. **DO NOT** create a public GitHub issue for security vulnerabilities
2. Use GitHub's Security Advisory feature to report privately
3. Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
### What to expect:
- Acknowledgment within 48 hours
- Regular updates on progress
- Credit in release notes (unless you prefer anonymity)
## Security Best Practices
### Docker Security
- Never run containers as root in production
- Use specific image tags, not `:latest`
- Regularly update base images
- Scan images with Trivy or similar tools
### API Keys & Secrets
- Never commit `.env` files
- Use Docker secrets in production
- Rotate tokens regularly
- Use least-privilege access
### Model Security
- Verify model checksums
- Only download models from trusted sources
- Be cautious with custom nodes from unknown sources
- Review code before installing custom nodes
### Network Security
- Don't expose ComfyUI directly to internet
- Use reverse proxy with authentication
- Enable HTTPS in production
- Restrict container network access
## Security Checklist
Before deploying to production:
- [ ] All secrets in environment variables
- [ ] Containers running as non-root user
- [ ] Network properly segmented
- [ ] Logs not containing sensitive data
- [ ] Regular security updates scheduled
- [ ] Backup strategy in place
- [ ] Access controls configured
- [ ] Monitoring and alerting setup
## Container Scanning
Run security scans regularly:
```bash
# Using Trivy
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
aquasec/trivy image mcp-comfyui-comfyui:latest
# Check for secrets
docker run --rm -v $(pwd):/src \
trufflesecurity/trufflehog:latest filesystem /src
```
## Dependencies
We regularly update dependencies to patch vulnerabilities:
- PyTorch and related libraries
- Node.js packages
- System packages in containers
## Incident Response
In case of a security incident:
1. Isolate affected systems
2. Assess the impact
3. Apply patches/fixes
4. Document lessons learned
5. Update security measures
## Contact
For security concerns, please use GitHub's Security Advisory feature or create a private security issue.
For general issues, use GitHub Issues.
