Responsible disclosure policy

[zidingz]

Hey there!

I belong to an open source security research community, and a member (@Haxatron) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

[patkon]

Hey @zidingz,
i will add a security.md the next days. Let me do a little more research, what's the best way to go.

[Haxatron]

Hi @patkon , here are the reports for the repository (in decreasing order of severity)

https://www.huntr.dev/bounties/3c293dca-d6ba-41b7-8954-8749d729a150/
https://www.huntr.dev/bounties/389d9b0f-d2d3-4355-ba11-99cff5ce0c91/
https://www.huntr.dev/bounties/62e2fd02-cdbf-4252-bbc3-f8c8fa8e13c4/
https://www.huntr.dev/bounties/c3ca21ca-6e10-4cba-82b3-d74bc7a7c62b/

When you are free, you can check them (only maintainers of a repository can view the report)

[Haxatron]

Note that these reports were tested on the latest version of flatcore-cms (the develop branch)

[patkon]

Hey @Haxatron, thank you. I will check this and do my best to fix the Bugs.
And thanks for the clear descriptions of the problems.

[Haxatron]

Hi @patkon , once you are done and have the free time, could you validate the reports and submit the fixes? You will also be rewarded the fix bounty once you do, for helping keep your software safe!

Thank you!

[patkon]

Hi @patkon , once you are done and have the free time, could you validate the reports and submit the fixes? You will also be rewarded the fix bounty once you do, for helping keep your software safe!

Thank you!

Yes, of course I will.. I've changed a lot and I'm currently testing whether everything still works as before.

[Haxatron]

Hi there, thanks for validating and fixing the vulnerabilities!

Have submitted 2 more reports:

https://huntr.dev/bounties/ee5fba4a-dd6a-4bba-b9dd-d73bcca0f38e/
https://huntr.dev/bounties/c32d57a0-2955-4bd5-80a9-9b5648ec2f28/

Please take your time to review them, don't want you to get overwhelmed 😅

[patkon]

Hi there, thanks for validating and fixing the vulnerabilities!

Have submitted 2 more reports:

https://huntr.dev/bounties/ee5fba4a-dd6a-4bba-b9dd-d73bcca0f38e/ https://huntr.dev/bounties/c32d57a0-2955-4bd5-80a9-9b5648ec2f28/

Please take your time to review them, don't want you to get overwhelmed 😅

Thank you.