mirror of
https://github.com/gotify/server.git
synced 2026-09-07 00:08:07 +08:00
30 lines
1.3 KiB
Markdown
30 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Only the latest released version.
|
|
|
|
If you found a vulnerability that only applies to older versions but has been accidentally fixed recently, please open a private advisory to let us evaluate if a backdated advisory is necessary.
|
|
|
|
If you found a vulnerability in unreleased code (Git trunk), please verify that the latest release is not affected and then use the public issue and pull request workflow to submit your research.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please report (suspected) security vulnerabilities to
|
|
[GitHub Advisory](https://github.com/gotify/server/security/advisories/new)
|
|
or **[gotify@protonmail.com](mailto:gotify@protonmail.com)**.
|
|
You will receive a response from us within a few days.
|
|
|
|
To reduce paperwork and align with CVE key details phrasing,
|
|
an executive summary containing the following elements is sufficient for most reports:
|
|
|
|
- The affected component (package, file, function, etc)
|
|
- The root cause (weakness in code, insecure default, misleading documentation, etc)
|
|
- The attack model (precondition, vector, impact)
|
|
- A PoC
|
|
|
|
If the issue is confirmed, we will release a
|
|
patch as soon as possible.
|
|
Additionally, we will submit findings that demonstrate the necessity for
|
|
user triage to the GitHub CNA Program.
|