mirror of
https://github.com/IliesAllali/parenthese.git
synced 2026-11-06 23:32:08 +00:00
27 lines
1.4 KiB
Markdown
27 lines
1.4 KiB
Markdown
# Security
|
|
|
|
[Version française](SECURITY.fr.md)
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Never describe a vulnerability in an issue, a discussion or a pull request: everything there is public.
|
|
|
|
Report it preferably through GitHub's private vulnerability reporting: the **Security** tab of this repository, "Report a vulnerability" button. If you can't use it, send an email to pro.allali.ilies@gmail.com.
|
|
|
|
If you can, say what is affected (address, API route, file), the steps to reproduce and the impact you observe. A short, precise report is enough. English or French, as you prefer.
|
|
|
|
## Scope
|
|
|
|
- The public instance [parenthese.io](https://parenthese.io): the website, the app and its API.
|
|
- The code in this repository, including the self-hosting setup (`docker-compose.yml`, Docker images, nginx configuration).
|
|
|
|
A self-hosted instance run by someone else is the responsibility of its administrator. If the vulnerability comes from the code, it is in scope.
|
|
|
|
On parenthese.io, test only with your own account and your own trees. Do not access other families' data, and no denial of service or large automated tests.
|
|
|
|
## Response time
|
|
|
|
Parenthèse is maintained by one person. You will get an acknowledgment as soon as possible, usually within a week. Serious vulnerabilities come before everything else. Once the fix is published, the vulnerability can be described publicly, leaving self-hosters time to update.
|
|
|
|
Only the latest version of the `main` branch receives fixes.
|