Erik Michelson
2.6 KiB
Security Policy
Supported Versions
Only the latest release of HedgeDoc is supported. We don't have the ressources to maintain multiple versions.
We currently do not accept vulnerability reports for preview releases
of the upcoming HedgeDoc 2.0. This version is still work-in-progress
with several (security) features missing. Production usage is not yet
recommended.
Security reports for preview releases of HedgeDoc 2.0 will be closed.
Reporting a Vulnerability
Please go to "Issues" > "New" > "Report a security vulnerability". This allows you to get in direct, but private contact with us. There is some more detailed documentation available by GitHub.
Tip
: In this form, only the title and description are mandatory [so don't worry if you can't fill everything]. […] However, we recommend security researchers provide as much information as possible on the form so that [we] can make an informed decision about the submitted report. You can adopt the template used by [GitHub's] security researchers from the GitHub Security Lab, which is available on the github/securitylab repository."
We'll get back to you as soon as possible. You can expect an answer within 3 days, in rare cases within a month. If you don't get a reply within a month, please reach out for other contact addresses in the community chat.
When your findings are accepted as a security issue, we'll work on a fix or at least a workaround for the next release. With the release that contained the fix, we want to encourage you to publish your findings as you like.
We'll also credit you in the release notes.
When your findings are not accepted as a security issue, feel free to write a fix yourself and contribute it to HedgeDoc, as well as publish them as you like and allow people to make an informed decision about using HedgeDoc.
If you have any further questions, feel free to reach out to the community chat or the mentioned contacts above.