OBM CE stores Odoo master passwords (encrypted with your FERNET_KEY) and your backup archives. We take reports seriously.

Please do not open a public issue for security problems.

• Preferred: GitHub's private vulnerability reporting — Security → Report a vulnerability on this repository.
• You should get a first response within 72 hours.

Please include reproduction steps and the version you are running (docker compose exec app python -c "import app; print(app.__version__)", or the image tag you pulled). We'll credit reporters in the release notes unless you ask otherwise.

Only the latest minor release receives security fixes.

• Serve behind HTTPS (COOKIE_SECURE=true) and never expose the container port directly to the internet.
• Keep FERNET_KEY and .env out of ./data and out of any backup of it.
• Use a dedicated Odoo master password per instance where possible.