mirror of
https://github.com/sol1/rustguac.git
synced 2026-10-25 21:19:45 +00:00
Dave Kempe
32 lines
1.3 KiB
Markdown
32 lines
1.3 KiB
Markdown
# Security policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report security problems privately, not in a public issue or pull request.
|
|
|
|
Use GitHub's private vulnerability reporting: on the repository's **Security** tab,
|
|
choose **Report a vulnerability**, or go to
|
|
https://github.com/sol1/rustguac/security/advisories/new
|
|
|
|
Include what you found, the version (`rustguac --version` or `dpkg -l rustguac`),
|
|
and how to reproduce it if you can. A proposed fix is welcome but not needed.
|
|
|
|
We'll acknowledge the report, keep it private while we fix it, and credit you in
|
|
the release notes unless you'd rather not be named. Please give us a chance to
|
|
release a fix before publishing details.
|
|
|
|
## Supported versions
|
|
|
|
Security fixes go into the latest release. Please upgrade to it before reporting,
|
|
and check the [releases](https://github.com/sol1/rustguac/releases) for whether
|
|
a problem is already fixed.
|
|
|
|
## Scope
|
|
|
|
rustguac itself: the web server, its API, the session client pages, and the
|
|
packaging in this repository (including the bundled, patched guacd build).
|
|
Problems in upstream projects (Apache Guacamole's guacd, FreeRDP, Vault or
|
|
OpenBao) are best reported to them, but tell us too if rustguac is affected.
|
|
|
|
See [docs/security.md](docs/security.md) for how rustguac is hardened.
|