This policy covers security issues in bbackup's source code and the packaged commands.

Version 2.0.7 includes documentation and release-readiness updates plus targeted build-tool security maintenance. It changes no production runtime behavior or qualification. Historically, v2.0.5 included the reviewed safety and schema-3 enrollment changes and the configurable central-retention grace fix. Check the GitHub Releases page for published versions; supported scope and historical qualification boundaries are in the qualification record. Reports for released and development code are welcome.

Security fixes are prepared for the latest published release. The project does not promise backports to older versions.

Do not post security vulnerabilities in a public issue. Use GitHub's private vulnerability reporting and include the affected version or commit, impact, and a safe reproduction when available. Redact secrets and customer data. The maintainers will acknowledge reports within five business days and coordinate any public disclosure with the reporter.

This policy covers bbackup's first-party code. It does not provide security support for the host operating system, restic, Docker, database servers, or third-party cloud providers and services.

Do not commit encryption keys, restic passwords, cloud credentials, tokens, host bindings, backup archives, or unredacted production configuration. Private files should have owner-only access. Keep independently recoverable copies of repository passwords and recovery-kit keys outside the host being protected.

Slavic Kozyuk
© 2026 Crux Experts LLC — MIT License