We treat security reports at highest priority level. This means that we attempt to fix them as quickly as possible. We will release a beta or hotfix for any major security report found in the most recent stable version of OpenPlants.

To report a vulnerability, please use the GitHub Security Advisories with a description of the problem, the steps you took to reproduce the problem, affected versions and any known mitigations.

We should reply within seven working days, probably much sooner.

We use GitHub's Security Advisory feature to track open security reports. You should expect a close collaboration as we work to resolve the security vulnerability you have reported. Please reach out to openplants+security@domai-tb.com if you do not receive prompt attention and regular updates.

If you believe that an existing GitHub issue is security-related, use your organization’s internal process or create a private advisory instead of discussing sensitive details publicly.

We prefer all communications to be in English or German.