IntenseFinance/zitadel
3
0 Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2026-10-25 07:37:43 -05:00
Code Issues Packages Projects Releases Wiki Activity

chore: Minor rework SECURITY.md (#11839)

Browse Source 
# Which Problems Are Solved

Paragraph reorganization of `SECURITY.md` and some minor changes

# How the Problems Are Solved

  - Move out of scope section under `Scope`
  - Update `Supported Versions` with an up to date link
  - Extend `Out of Scope`

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Marco A.andCopilot authored and GitHub committed 2026-03-20 08:23:25 +00:00
1 parent 8d1a099deb
commit f3ff0d59ec
1 file changed
+8 -8
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+8 -8
View File
@@ -16,8 +16,14 @@ Please refer to the separate [vulnerability disclosure policy](https://zitadel.c
### Supported Versions
Supported are releases that are newer and not older than 6 months from our stable release
https://github.com/zitadel/zitadel/blob/main/release-channels.yaml#L1
Supported are releases that are newer and not older than 6 months from our stable release. You can read more about the release cycle [here](https://zitadel.com/docs/product/release-cycle)
### Out of scope (what is NOT a security vulnerability)
- Disclosure of known public files or directories, e.g. robots.txt, files under .well-known, or files that are included in our public repositories (e.g. `go.mod`)
- DoS of users when [Lockout Policy is enabled](https://zitadel.com/docs/guides/manage/console/default-settings#lockout)
- You need help applying security related settings
- When messages sent by Zitadel are reprocessed by third-party clients that automatically change the content of the message.
## Reporting a vulnerability
@@ -39,12 +45,6 @@ If you haven't received a response within 48 hours, or you didn't get a reply fr
Please inform us in your report whether we should mention your contribution.
We will not publish this information by default to protect your privacy.
### When should I NOT report a vulnerability
- Disclosure of known public files or directories, e.g. robots.txt, files under .well-known, or files that are included in our public repositories (e.g. `go.mod`)
- DoS of users when [Lockout Policy is enabled](https://zitadel.com/docs/guides/manage/console/default-settings#lockout)
- You need help applying security related settings
## Disclosure Process
Our security team will follow the disclosure process: