diff --git a/SECURITY.md b/SECURITY.md index a2658f9e..380772c6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,45 +1,11 @@ # Security Policy -As announced in the [README](README.md) I only support the latest available release and `main` branch. +As announced in the [README](README.md) security fixes will only be added to the `main` branch. | Version | Supported | |----------------------|--------------------| | main branch | :white_check_mark: | -| latest minor release | :white_check_mark: | | older releases | :x: | -## Reporting a Vulnerability -Please read the [Bughunter](https://www.kimai.org/documentation/bughunter.html) documentation before posting. -You can report any security related vulnerability in the [advisory section at GitHub](https://github.com/kimai/kimai/security/advisories) -or via email to [support@kimai.org](mailto:support@kimai.org). - -I will work as fast as I can to fix the problem and publish a bugfix release / security update. -Depending on the size of the required fixes, this might take a couple of hours or a couple of days. - -You can expect that your message will be answered ASAP. - -Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. -Only interact with accounts you own or with explicit permission of the account holder. - -## Exclusions - -While researching, please refrain from: - -- Denial of service -- Spamming -- Social engineering (including phishing) - -YOU MAY NOT TEST AGAINST SERVERS (e.g. Kimai-Cloud, Demo) YOU DO NOT HAVE EXPLICIT PERMISSION TO TEST. - -There are official laws in the EU, that force the owner of a service to report any attack to the authorities. - -## Reward - -You will be mentioned in the release notes if your issue is valid. - -I am grateful for any (discrete) disclosure of vulnerabilities! - -## Bug bounty - -Please note: if you are asking for money, I will not reply. I receive too many of these scam messages every day. +You find all information in our [Bughunter documentation](https://www.kimai.org/documentation/bughunter.html).