We release patches for security vulnerabilities. Which versions are eligible receiving such patches depend on the CVSS v3.0 Rating:
| CVSS v3.0 | Supported Versions |
|---|---|
| 8.0-10.0 | Major version releases within the previous three months |
| 4.0-7.9 | Most recent release |
If you believe you've found a security vulnerability in this project please utilize our HackerOne bug bounty program by going to https://hackerone.com/shipt/?type=team.
Once submitted, someone on our team will review it shortly, typically within 1 business day. If the issue is confirmed, we will release a patch as soon as possible depending on complexity but historically within a few days.
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Please include as much of the information listed below as you can to help us better understand and resolve the issue:
- The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
- Full paths of source file(s) related to the manifestation of the issue
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit the issue
This information will help us triage your report more quickly.