IntenseFinance/firefly-iii
3
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2026-08-26 13:17:30 -05:00
Code Issues Packages Projects Releases Wiki Activity

Clarify security issue reporting guidelines

Browse Source 
Signed-off-by: James Cole <james@firefly-iii.org>
This commit is contained in:
James Cole
2026-08-20 08:04:49 +02:00
committed by GitHub
parent fd8791d08d
commit 46728cb71e
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/security.md
+4 -2
View File
@@ -24,10 +24,12 @@ any the following security issues may result in a permanent ban from the Firefly
1. Any SSRF or DNS/hostname issues in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design 1. Any SSRF or DNS/hostname issues in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design
that users may set up any URL they want, be it internal, private or non-existing. that users may set up any URL they want, be it internal, private or non-existing.
2. Any XSS issue without a viable attack tree. See also the heading "attack service and risk assessment" earlier in this 2. Any (XSS) issue without a viable attack tree. See also the heading "attack service and risk assessment" earlier in this
policy. If you can find a spot where Firefly III or the associated tools render unescaped data, it's not a security policy. If you can find a spot where Firefly III or the associated tools render unescaped data, it's not a security
issue unless you can show me an actual attack that gets that data into the system. issue unless you can show me an actual attack that gets that data into the system.
3. Any issue that is not true. AI models have already *hallucinated* security issues in Firefly III. They've 3. There are (end)points where one (non-admin) user can affect all other users. For example, browsing to `/flush` will
also clear out other user's cached data. Purging deleted records may also remove other user's soft-deleted data.
4. Any issue that is not true. AI models have already *hallucinated* security issues in Firefly III. They've
referred to **non-existing** functions, templates and files. Including line numbers and code excerpts. Validate your referred to **non-existing** functions, templates and files. Including line numbers and code excerpts. Validate your
findings before you report them to me. findings before you report them to me.