Reporting vulnerabilities

Thanks for taking interest in the security of froxlor! We are mostly interested in reports by actual froxlor users, but all high quality contributions are welcome.

Reporting a vulnerability

Please report vulnerabilities privately via GitHub Security Advisories only – not by e-mail, public issues, pull requests or social media. Please describe as precisely as possible:

• the affected version and configuration,
• steps to reproduce (ideally on a fresh default installation),
• the realistic impact.

Please give us appropriate time to fix the issue and ship updates before publishing any details. We keep you posted through the advisory.

Supported versions

Version	Security updates
2.3.x	✅ yes
≤ 2.2.x	❌ no

What we really care about

SQL injection, server-side code execution, cross-site scripting, cross-site request forgery, authentication and authorization flaws, and disclosure of sensitive information.

Non-qualifying

Reports from automated scanners without proof, theoretical attacks, vulnerabilities in third-party libraries (please report them to their maintainers), social engineering, attacks requiring security features to be disabled, actions of an administrator against their own system, weak TLS/SSH algorithms, and physical access or already compromised systems.

The full policy is also available in the repository. Machine-readable contact details: /.well-known/security.txt.