cgalo5758
0c78d5f425
Replace status/issues.md and status/milestones.md with the Gitea forge tracker, add issue templates, and archive pre-forge issues as YAML.
43 lines
1.5 KiB
Markdown
43 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
member-console is **pre-production** and under active development. Security fixes
|
|
are applied to the `main` branch only; there are no separately maintained release
|
|
branches yet.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public issues, pull
|
|
requests, or discussions.**
|
|
|
|
Instead, report them privately so we can assess and fix the issue before it is
|
|
publicly disclosed.
|
|
|
|
- Email **mail@wiki.cafe** with a description of the issue and, if possible,
|
|
steps to reproduce.
|
|
|
|
Please include:
|
|
|
|
- a description of the vulnerability and its potential impact,
|
|
- steps to reproduce or a proof of concept,
|
|
- any affected versions, configuration, or components (for example, the operator
|
|
panel, the Stripe webhook pipeline, or a provider integration).
|
|
|
|
## What to expect
|
|
|
|
- We will acknowledge your report as soon as we are able.
|
|
- We will investigate, keep you informed of progress, and let you know when a fix
|
|
is available.
|
|
- We will credit reporters who wish to be named once a fix has shipped, unless
|
|
you prefer to remain anonymous.
|
|
|
|
## Scope
|
|
|
|
Because this is a self-hostable application, some risk depends on how a given
|
|
deployment is configured. Reports that involve the code in this repository — the
|
|
member console, its operator/member surfaces, its webhook and workflow
|
|
processing, or the provider-extension contract — are in scope. The test stack
|
|
under [`test/`](test/) ships with deliberately non-secret development
|
|
credentials; those are not vulnerabilities.
|