jcoffey-dev
dad53d602a
Security reports now go to [email protected] and code-of-conduct reports to [email protected], replacing a personal address. Written in the same obfuscated form as before.
1.4 KiB
1.4 KiB
Security Policy
Supported Versions
Security fixes go into the latest release. Older releases do not receive backported fixes; a fixed release is a download away, and the tool keeps no state of its own between runs.
| Version | Supported |
|---|---|
| Latest release | ✅ |
| Older releases | ❌ |
Reporting a Vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report them privately by emailing securityATcoffeylabsDOTorg, with:
- A description of the issue and its impact
- Steps to reproduce
- The ihasmail-oneshot version (
ihasmail-oneshot version) - Whether it is in the tool itself or in the deployment it writes
You should hear back within a few days. Once a fix is released, disclosure timing and credit are coordinated with you.
Scope
In scope:
- Secrets the tool generates or writes: file modes, where they end up, what outlives the setup
- The deployment it writes: what it publishes, and what it tells Stalwart to trust (forwarded client addresses, addresses exempt from bans)
- The Caddyfile and compose.yaml it renders
Out of scope, and best reported upstream:
- Vulnerabilities in Stalwart itself
- Vulnerabilities in ihasmail itself — see its security policy
- Vulnerabilities in Caddy or Docker