IntenseFinance/zitadel
3
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2026-08-17 16:35:14 -05:00
Code Issues Packages Projects Releases Wiki Activity

docs: Update security.md (#12267)

Browse Source 
We introduce a common vulnerabiltiy policy and a from for reporting
vulnerabilties.
This commit is contained in:
Maximilian
2026-06-10 11:53:26 +00:00
committed by GitHub
parent 385c5ae54b
commit c5463b51ff
1 changed files with 13 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+13 -48
View File
@@ -1,59 +1,24 @@
# Security Policy
## Introduction
## Reporting Security Issues
At ZITADEL we are extremely grateful for security aware people who disclose vulnerabilities to us and the open source community.
All reports will be investigated by our team, and we will work with you closely to validate and fix vulnerabilities reported to us.
We take the security of ZITADEL very seriously. If you believe you have found a security vulnerability in ZITADEL, we encourage you to report it to us immediately.
We require that you keep vulnerabilities confidential until we are able to address them, since public disclosure of security vulnerabilities could put the ZITADEL community at risk.
**Please do not report security-related findings publicly via GitHub issues.** Public disclosure of a security vulnerability could put the ZITADEL community at risk. Instead, please use our official vulnerability disclosure process.
## Scope
### Vulnerability Disclosure Process
The scope of this policy applies to all security issues that concern our Product in form of Software in our [open source repositories](https://github.com/zitadel).
Vulnerabilities should be reported through our dedicated portal:
**[zitadel.com/vulnerability](https://zitadel.com/vulnerability)**
Out of scope are all websites and services operated by ZITADEL (CAOS Ltd.).
Please refer to the separate [vulnerability disclosure policy](https://zitadel.com/docs/legal/policies/vulnerability-disclosure-policy).
For more details on our vulnerability policy, including scope and expectations, please refer to our official policy document:
**[ZITADEL Vulnerability Disclosure Policy](https://trust.zitadel.com/resources?s=aw085mxrel3icmbmkphns3&name=zitadel-vulnerability-disclosure-policy)**
### Supported Versions
### Definitive Source
Supported are releases that are newer and not older than 6 months from our stable release. You can read more about the release cycle [here](https://zitadel.com/docs/product/release-cycle)
When in doubt, the authoritative and most up-to-date source for our security reporting information is always our `security.txt` file:
**[zitadel.com/.well-known/security.txt](https://zitadel.com/.well-known/security.txt)**
### Out of scope (what is NOT a security vulnerability)
---
- Disclosure of known public files or directories, e.g. robots.txt, files under .well-known, or files that are included in our public repositories (e.g. `go.mod`)
- DoS of users when [Lockout Policy is enabled](https://zitadel.com/docs/guides/manage/console/default-settings#lockout)
- You need help applying security related settings
- When messages sent by Zitadel are reprocessed by third-party clients that automatically change the content of the message.
## Reporting a vulnerability
To file an incident, please disclose it by e-mail to [security@zitadel.com](mailto:security@zitadel.com) including the following details of the vulnerability:
- Target: ZITADEL, Website (zitadel.com), ZITADEL Cloud (zitadel.cloud), Other (please describe)
- Type: For example DoS, authentication bypass, information disclosure, broken authorization, ...
- Description: Provide a detailed explanation of the issue, steps to reproduce, and assumptions you have made
- URL / Location (optional): The URL of the vulnerability
- Contact details (optional): In case we should contact you on a different channel
At the moment GPG encryption is no yet supported, however you may sign your message at will.
Your email will be acknowledged within 48 hours.
We will follow up within the next 3 business days indicating next steps in handling your report.
If you haven't received a response within 48 hours, or you didn't get a reply from our security team within the last 5 days, please contact [support@zitadel.com](mailto:support@zitadel.com).
Please inform us in your report whether we should mention your contribution.
We will not publish this information by default to protect your privacy.
## Disclosure Process
Our security team will follow the disclosure process:
1. We will acknowledge the receipt of your vulnerability report
2. Our security team will try to verify, reproduce, and determine the impact of your report
3. A member of our team will respond to either confirm or reject your report, including an explanation
4. Code will be audited to assess if the report uncovers similar issues
5. Fixes are prepared for the latest release
6. On the date that the fixes are applied, we will create a CVE and publish a [security advisory](https://github.com/zitadel/zitadel/security/advisories). Affected users of our Product, Services, or Website will be informed of the fix and required actions.
We think it is crucial to publish advisories `ASAP` as mitigations are ready. But due to the unknown nature of the disclosures the time frame can range from 7 to 90 days.
We appreciate your help in keeping ZITADEL and its community safe!