46 lines
1.7 KiB
Markdown
46 lines
1.7 KiB
Markdown
# Security Policy
|
|
|
|
As announced in the [README](README.md) I only support the latest available release and `main` branch.
|
|
|
|
| Version | Supported |
|
|
|----------------------|--------------------|
|
|
| main branch | :white_check_mark: |
|
|
| latest minor release | :white_check_mark: |
|
|
| older releases | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please read the [Bughunter](https://www.kimai.org/documentation/bughunter.html) documentation before posting.
|
|
You can report any security related vulnerability in the [advisory section at GitHub](https://github.com/kimai/kimai/security/advisories)
|
|
or via email to [support@kimai.org](mailto:support@kimai.org).
|
|
|
|
I will work as fast as I can to fix the problem and publish a bugfix release / security update.
|
|
Depending on the size of the required fixes, this might take a couple of hours or a couple of days.
|
|
|
|
You can expect that your message will be answered ASAP.
|
|
|
|
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
|
|
Only interact with accounts you own or with explicit permission of the account holder.
|
|
|
|
## Exclusions
|
|
|
|
While researching, please refrain from:
|
|
|
|
- Denial of service
|
|
- Spamming
|
|
- Social engineering (including phishing)
|
|
|
|
YOU MAY NOT TEST AGAINST SERVERS (e.g. Kimai-Cloud, Demo) YOU DO NOT HAVE EXPLICIT PERMISSION TO TEST.
|
|
|
|
There are official laws in the EU, that force the owner of a service to report any attack to the authorities.
|
|
|
|
## Reward
|
|
|
|
You will be mentioned in the release notes if your issue is valid.
|
|
|
|
I am grateful for any (discrete) disclosure of vulnerabilities!
|
|
|
|
## Bug bounty
|
|
|
|
Please note: if you are asking for money, I will not reply. I receive too many of these scam messages every day.
|