Security advisories

01

Open advisories

None.

No advisory is open. When one is, it appears here on the day it is published, with the affected versions and the fix. A page that lists nothing is only useful if it is also the page that would list something, which is why this one exists before there is anything to put on it.

02

What an advisory states

An advisory names the affected component and versions, what an attacker could do, whether the flaw can be triggered without local access, which release carries the fix, and what an operator has to do. Self-hosted installs get the same advisory as the hosted service, because the code is the same.

We publish an advisory for a flaw we fixed even when we believe no install was exposed. An operator who patches on a delay is better served by the reasoning than by a silence.

03

Reporting one

Write to [email protected]. You do not have to sign anything before you tell us. We read it, we tell you what we found and when we expect to fix it, and we credit you by name if you want the credit. A penetration test of your own environment is yours to commission; ours is not claimed, and the list of what we do not claim is in the security page.