Skip to content

Latest commit

 

History

History
23 lines (17 loc) · 1.25 KB

SECURITY.md

File metadata and controls

23 lines (17 loc) · 1.25 KB
Raw

Security policy

Supported versions

Only lastest two minor version releases are supported (>= 0.12) for accepting vulnerability reports and patching fixes.

Existing vulnerability reports are being tracked in Gogs Vulnerability Reports.

Vulnerability lifecycle

  1. Report a vulnerability:
    • We strongly enourage to use https://huntr.dev/ for submitting and managing status of vulnerability reports.
    • Alternatively, you may send vulnerability reports through emails to [email protected].
  2. Create a dummy issue with high-level description of the security vulnerability for credibility and tracking purposes.
  3. Project maintainers review the report and either:
    • Ask clarifying questions
    • Confirm or deny the vulnerability
  4. Once the vulnerability is confirmed, the reporter may submit a patch or wait for project maintainers to patch.
    • The latter is usually significantly slower.
  5. Patch releases will be made for the supported versions.
  6. Publish the original vulnerability report and a new GitHub security advisory.

Thank you!