Security fixes are applied to the latest version on the main branch.
Please do not open a public issue for security vulnerabilities.
Use GitHub private vulnerability reporting instead:
- Go to the repository's Security tab.
- Click Report a vulnerability.
- Describe the issue, the affected component (
apps/platform-api,apps/file-gateway-api,apps/platform,packages/go-packages), and reproduction steps if possible.
We will respond through the advisory thread. Please give us a reasonable amount of time to address the issue before any public disclosure.
- Authentication/authorization bypasses
- Injection of any kind (SQL, command, template, ...)
- Sensitive data exposure
- SSRF, XSS, CSRF and similar web vulnerabilities
- Vulnerabilities in the file upload/download pipeline
Self-hosted deployment misconfigurations (e.g. exposing the database port publicly, running with example secrets) are out of scope.