jcoffey-dev
aa44c63f6d
Private vulnerability reporting is on for the GitHub copy, so its "Report a vulnerability" form is a second private route besides email.
1.9 KiB
Security policy
Supported versions
Security fixes go into the newest release and into every older line still inside its security window. When a new series ships, the one before it gets three more months of security fixes. The full policy is on Versions and upgrades.
| Version | Supported |
|---|---|
main and the newest release |
✅ |
| The previous series, for three months after a new one ships | Security fixes only |
| 2026.x, until three months after 27.1 ships | Security fixes only |
| Release candidates | Replaced by the next candidate |
| Anything older | ❌ |
Reporting a vulnerability
Please don't open a public issue for a security problem. An issue is visible to everyone, including whoever would use it, before there is a fix.
Report it privately by email to:
securityATcoffeylabsDOTorg
Or use Report a vulnerability on the GitHub copy's Security tab, which reaches the same people privately.
Include as much as you can of:
- what the vulnerability is, and what it lets someone do;
- how to reproduce it, or a proof of concept;
- the version or commit affected;
- anything about the deployment that matters — backend, front ends, whether it needs an authenticated account.
You'll get an acknowledgement within a few days. If the problem is also in upstream Stalwart, it still gets fixed here, and you'll be told so you can report it to Stalwart Labs yourself. We don't forward reports to them.
Scope
This repository is the mail server. The web front ends have their own:
Upstream's own security documents are kept in .github-upstream/ for
reference. They describe Stalwart Labs' process, not this project's.