jjsm01/kimai2
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

link security guidelines on the website

Browse Source
This commit is contained in:
Kevin Papst
2024-08-05 18:44:38 +02:00
parent 0bcd45babe
commit 62047c7c01
1 changed files with 2 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
SECURITY.md
View File

@@ -1,45 +1,11 @@
# Security Policy
As announced in the [README](README.md) I only support the latest available release and `main` branch.
As announced in the [README](README.md) security fixes will only be added to the `main` branch.
| Version | Supported |
|----------------------|--------------------|
| main branch | :white_check_mark: |
| latest minor release | :white_check_mark: |
| older releases | :x: |
## Reporting a Vulnerability
Please read the [Bughunter](https://www.kimai.org/documentation/bughunter.html) documentation before posting.
You can report any security related vulnerability in the [advisory section at GitHub](https://github.com/kimai/kimai/security/advisories)
or via email to [support@kimai.org](mailto:support@kimai.org).
I will work as fast as I can to fix the problem and publish a bugfix release / security update.
Depending on the size of the required fixes, this might take a couple of hours or a couple of days.
You can expect that your message will be answered ASAP.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Only interact with accounts you own or with explicit permission of the account holder.
## Exclusions
While researching, please refrain from:
- Denial of service
- Spamming
- Social engineering (including phishing)
YOU MAY NOT TEST AGAINST SERVERS (e.g. Kimai-Cloud, Demo) YOU DO NOT HAVE EXPLICIT PERMISSION TO TEST.
There are official laws in the EU, that force the owner of a service to report any attack to the authorities.
## Reward
You will be mentioned in the release notes if your issue is valid.
I am grateful for any (discrete) disclosure of vulnerabilities!
## Bug bounty
Please note: if you are asking for money, I will not reply. I receive too many of these scam messages every day.
You find all information in our [Bughunter documentation](https://www.kimai.org/documentation/bughunter.html).