jcoffey-dev
3e7bb80f73
GitHub took the organization's repos and GHCR offline on 2026-09-20. Repo, release, raw-file and clone links now go to Gitea at git.coffeylabs.org, container images to registry.coffeylabs.org, and GitLab-style /-/blob paths to Gitea's /src/branch form. Go module paths are identifiers and stay as they are; links to GitHub issues and pull requests are left as history.
1.4 KiB
Security policy
Supported versions
INBUXA Admin is developed on main, and security fixes are applied there and
in the latest release. Older tags are not backported.
| Version | Supported |
|---|---|
main and the latest release |
✅ |
| Older releases | ❌ |
Reporting a vulnerability
Please don't open a public issue for a security problem. An issue is visible to everyone, including whoever would use it, before there is a fix.
Report it privately by email to:
johnellisATlinuxDOTcom
Include as much as you can of: what it lets someone do, how to reproduce it, the version or commit affected, and whether it needs an authenticated session or a particular role.
This is an administrative interface, so a few things are worth calling out as in scope even though they are not bugs in the usual sense: anything that lets a session act beyond the permissions its account holds, anything that leaks another tenant's data, and anything that exposes a token or a secret to a place it should not reach — the URL, the page, or storage that outlives the session.
You'll get an acknowledgement within a few days. A report that turns out to affect the mail server rather than this interface will be moved to inbuxa-server, and one that affects upstream Stalwart's web interface will be passed to Stalwart Labs with credit to you.