There was no security policy in this repository, and no "Report a
vulnerability" button either — private reporting was switched off, so the
Security tab offered an outside researcher nothing to press. The Docker Hub
description meanwhile told people to report privately through GitHub
advisories, which is advice for a thing that did not exist. The likely
outcome of that combination is somebody filing a working exploit as a
public issue, having tried to do the right thing first.
Reporting is on now, for this repository and for both public packages. This
is the policy that goes with it.
v1's policy was the starting point and about half of it survived. The
address is the same, contact@projectsend.org, which is still live and still
in CONTRIBUTING.md and both CLAs. "Do not open a public issue" is still the
point. What did not carry: it predates private reporting and would have
contradicted what we already tell Docker users, and it sent readers to v1's
SECURITY_HARDENING.md — eight kilobytes about hand-writing Nginx and Apache
rules to keep uploads private, which in v2 ship in the nginx config and are
already in place inside the image. Pointing a v2 operator at it would be
pointing them at a different architecture.
What is new is what v1 never needed: which versions are supported, now that
there are version numbers and two packages on their own lines, and a
sentence on what is not a vulnerability — an installation that skipped the
install guide, an unread scanner report, a dependency finding Dependabot
already watches.
The response times are deliberately modest and honest about the size of
this project, including what to do about silence. Better that than an SLA
nobody is on call for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ignacionelson