Please do not report security vulnerabilities through public GitHub issues, pull requests or discussions.

Report them privately by email to security@openctem.io.

Include as much of the following as you can:

• the affected component and version (release tag or commit);
• a description of the issue and its impact;
• the steps to reproduce it, or a proof of concept;
• any configuration needed to reproduce it;
• whether the issue is already public or known to others;
• how you would like to be credited, if at all.

• We acknowledge your report within 3 business days.
• We triage it and tell you our assessment within 10 business days.
• We fix confirmed vulnerabilities and coordinate the disclosure with you. A typical fix ships within 90 days of the report; we keep you informed if it takes longer.
• We credit reporters in the release notes unless they prefer otherwise.

Security fixes go into the latest release of openctemio/ci (the openctem-ci binary, the images, the GitHub Action, the reusable workflow and the GitLab templates). Upgrade to the latest release before reporting, where you can.

We will not take legal action against, or ask law enforcement to investigate, anyone who researches and reports a vulnerability in good faith under this policy: who avoids privacy violations, data destruction and service disruption, tests only against systems they own or are authorized to test, and gives us reasonable time to fix the issue before disclosing it.

The full disclosure policy: https://docs.openctem.io/security/vulnerability-disclosure/. For anything that is not a vulnerability, contact info@openctem.io.