Only the latest version of this project is supported. As such, we encourage users to keep their installations up-to-date.
We appreciate the efforts of security researchers and encourage responsible disclosure of any vulnerabilities you might find. Responsible disclosure includes:
Providing us a reasonable amount of time to fix the issue before publishing it. Making an effort to avoid privacy violations, destruction of data and interruption or degradation of our services.
While we strive to produce high-quality, secure software, it's important for users of this project to keep in mind:
Always keep your own systems and software up-to-date. Practice secure coding when extending or integrating with this project. Code injections are one of the most common vulnerabilities. Do not share sensitive information, such as passwords or API keys, within the project's code or version control history. Regularly review and minimize the permissions granted to this project, especially when integrating with other software or public services. Please keep in mind that this is a general-purpose security policy. Depending on the specific requirements of your project, you may need to add, remove, or alter sections of this policy. Always consult with a security expert when creating or modifying a security policy.
If you discover a security issue in this project, please report it by sending an email to [email protected]. Do not create an issue on GitHub for a security vulnerability.
When a security issue is discovered, we will release a patch as soon as possible. Depending on the severity and complexity of the issue, a patch could be released anywhere from the same day to the next few weeks.
If you'd like to be notified about security patches, we recommend either "Watching" this repository on GitHub or periodically visiting our GitHub page to check for updates.