Christian Krakau-Louis
2.2 KiB
2.2 KiB
Security Policy
Supported Versions
| Version | Supported |
|---|---|
| 0.4.x | ✅ |
| 0.3.x | ✅ |
| 0.2.x | ✅ |
| < 0.2 | ❌ |
Each version will be supported for six months after release or until a new release has been made, whichever is longer.
Reporting a Vulnerability
We take the security of our document-processor seriously. If you believe you've found a security vulnerability, please follow these steps:
How to Report
- Do NOT disclose the vulnerability publicly until it has been addressed by our team.
- Email your findings to security@christianlouis.de. Encrypt your message if it contains sensitive details.
- Include as much information as possible:
- Type of vulnerability
- Full paths of source files related to the vulnerability
- Step-by-step instructions to reproduce the issue
- Proof of concept code, if possible
- Impact of the vulnerability
What to Expect
- A confirmation email within 48 hours acknowledging your report.
- An assessment and validation of the reported vulnerability within 1 week.
- Regular updates about the progress of addressing the vulnerability.
- Credit for discovering and reporting the vulnerability (if desired).
Disclosure Policy
- Please allow us reasonable time to resolve the issue before making any public disclosures.
- We aim to address confirmed vulnerabilities within 30-90 days, depending on complexity.
- Once the vulnerability is fixed, we'll publish a security advisory with details and credit.
Security Best Practices
When using document-processor:
- Keep your installation up-to-date with the latest security patches
- Use strong access controls and authentication mechanisms
- Validate all inputs from untrusted sources
- Follow the principle of least privilege when configuring permissions
Security Updates
Security updates will be released as part of our regular versioning process. Critical security fixes may be released as out-of-band updates.
Acknowledgments
We'd like to thank the following individuals for responsibly reporting security issues:
This list will be updated as contributions are received.