1.7 KiB
Security Policy
As announced in the README I only support the latest available release and main branch.
| Version | Supported |
|---|---|
| main branch | ✅ |
| latest minor release | ✅ |
| older releases | ❌ |
Reporting a Vulnerability
Please read the Bughunter documentation before posting. You can report any security related vulnerability in the advisory section at GitHub or via email to support@kimai.org.
I will work as fast as I can to fix the problem and publish a bugfix release / security update. Depending on the size of the required fixes, this might take a couple of hours or a couple of days.
You can expect that your message will be answered ASAP.
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Exclusions
While researching, please refrain from:
- Denial of service
- Spamming
- Social engineering (including phishing)
YOU MAY NOT TEST AGAINST SERVERS (e.g. Kimai-Cloud, Demo) YOU DO NOT HAVE EXPLICIT PERMISSION TO TEST.
There are official laws in the EU, that force the owner of a service to report any attack to the authorities.
Reward
You will be mentioned in the release notes if your issue is valid.
I am grateful for any (discrete) disclosure of vulnerabilities!
Bug bounty
Please note: if you are asking for money, I will not reply. I receive too many of these scam messages every day.