mirror of
https://github.com/lnbits/lnbits.git
synced 2026-08-13 12:42:47 +02:00
37 lines
1.5 KiB
Markdown
37 lines
1.5 KiB
Markdown
|
# Security Policy
|
||
|
|
|
||
|
|
## Supported Versions
|
||
|
|
|
||
|
|
Security fixes are provided for the current released version of LNbits and the
|
||
|
|
`dev` branch. Older releases and release candidates are not supported unless a
|
||
|
|
maintainer explicitly states otherwise.
|
||
|
|
|
||
|
|
| Version | Supported |
|
||
|
|
| ------------------ | --------- |
|
||
|
|
| Current release | Yes |
|
||
|
|
| `dev` branch | Yes |
|
||
|
|
| Older releases | No |
|
||
|
|
| Release candidates | No |
|
||
|
|
|
||
|
|
## Reporting a Vulnerability
|
||
|
|
|
||
|
|
Please report suspected vulnerabilities privately using [GitHub's private
|
||
|
|
vulnerability reporting](https://github.com/lnbits/lnbits/security/advisories/new).
|
||
|
|
Do not open a public issue, discussion, or pull request for a security
|
||
|
|
vulnerability.
|
||
|
|
|
||
|
|
Include enough detail for maintainers to reproduce and assess the issue, such
|
||
|
|
as the affected version or commit, configuration, steps to reproduce, impact,
|
||
|
|
and any proof of concept. Do not include credentials, API keys, wallet data, or
|
||
|
|
other sensitive information unless it is necessary and can be shared safely.
|
||
|
|
|
||
|
|
Maintainers will acknowledge the report, investigate it, and coordinate a fix
|
||
|
|
and disclosure timeline with you. Please allow time for a fix to be prepared
|
||
|
|
before publicly disclosing the vulnerability.
|
||
|
|
|
||
|
|
## Scope
|
||
|
|
|
||
|
|
This policy covers the LNbits core repository and LNbits extensions in the LNbits GitHub organisation. Vulnerabilities in third-party
|
||
|
|
funding sources, dependencies or hosted LNbits instances may need to be reported to their respective maintainers or
|
||
|
|
operators as well.
|