Skip to content

doc(security): amend outdated security policy info #993

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eternal-flame-AD wants to merge 1 commit into
base: master
Choose a base branch
from
+20 −3
Open

doc(security): amend outdated security policy info #993

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,28 @@

## Supported Versions

Only the latest version.
Only the latest released version.

If you found a vulnerability that only applies to older versions but has been accidentally fixed recently, please also open a private advisory to let us evaluate if a backdated advisory is necessary.

@jmattheis jmattheis Jul 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If you found a vulnerability that only applies to older versions but has been accidentally fixed recently, please also open a private advisory to let us evaluate if a backdated advisory is necessary.
If you found a vulnerability that only applies to older versions but has been accidentally fixed recently, please open a private advisory to let us evaluate if a backdated advisory is necessary.


If you found a vulnerability in unreleased code (Git trunk), please verify that the latest release is not affected and then use the public issue and pull request workflow to submit your research.

## Reporting a Vulnerability

Please report (suspected) security vulnerabilities to
**[gotify@protonmail.com](mailto:gotify@protonmail.com)**. You will receive a
response from us within a few days. If the issue is confirmed, we will release a
[GitHub Advisory](https://github.com/gotify/server/security)

@jmattheis jmattheis Jul 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this link directly to https://github.com/gotify/server/security/advisories/new?

or **[gotify@protonmail.com](mailto:gotify@protonmail.com)**.
You will receive a response from us within a few days.

@jmattheis jmattheis Jul 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(optional) There are three lines with trailing whitespaces in this file. Please remove them.


To reduce paperwork and align with CVE key details phrasing,
an executive summary containing the following elements is sufficient for most reports:

- The affected component (package, file, function, etc)
- The root cause (weakness in code, insecure default, misleading documentation, etc)
- The attack model (precondition, vector, impact)
- A PoC

If the issue is confirmed, we will release a
patch as soon as possible.
Additionally, we will submit findings that demonstrate the necessity for
user triage to the GitHub CNA Program.
Loading