jcoffey-dev
7d2c2d2322
ci / build (pull_request) Successful in 6m51s
GitHub took the organization's repos and GHCR offline on 2026-09-20. Repo, release, raw-file and clone links now go to Gitea at git.coffeylabs.org, container images to registry.coffeylabs.org, and GitLab-style /-/blob paths to Gitea's /src/branch form. Go module paths are identifiers and stay as they are; links to GitHub issues and pull requests are left as history.
43 lines
1.4 KiB
Markdown
43 lines
1.4 KiB
Markdown
# Security policy
|
|
|
|
## Supported versions
|
|
|
|
INBUXA is developed on `main`, and security fixes are applied there and in
|
|
the latest release. Older tags are not backported.
|
|
|
|
| Version | Supported |
|
|
| --- | --- |
|
|
| `main` and the latest release | :white_check_mark: |
|
|
| Older releases | :x: |
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please don't open a public issue for a security problem.** An issue is
|
|
visible to everyone, including whoever would use it, before there is a fix.
|
|
|
|
Report it privately by email to:
|
|
|
|
**johnellisATlinuxDOTcom**
|
|
|
|
Include as much as you can of:
|
|
|
|
- what the vulnerability is, and what it lets someone do;
|
|
- how to reproduce it, or a proof of concept;
|
|
- the version or commit affected;
|
|
- anything about the deployment that matters — backend, front ends, whether
|
|
it needs an authenticated account.
|
|
|
|
You'll get an acknowledgement within a few days. If a report turns out to
|
|
affect upstream Stalwart rather than this fork's own code, it will be passed
|
|
to Stalwart Labs with credit to you, and you'll be told that has happened.
|
|
|
|
## Scope
|
|
|
|
This repository is the mail server. The web front ends have their own:
|
|
|
|
- [inbuxa-admin](https://git.coffeylabs.org/inbuxa/inbuxa-admin)
|
|
- [ihasmail-inbuxa](https://git.coffeylabs.org/inbuxa/ihasmail-inbuxa)
|
|
|
|
Upstream's own security documents are kept in `.github-upstream/` for
|
|
reference. They describe Stalwart Labs' process, not this project's.
|