Does any contributors really look into security vulnerability?

[zn9988]

I submitted security vulnerability last week but haven't receive any response. Does anyone really look into security advisory ? You can find my submitted vulnerability in here: https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p

At least provide a acknowledgement so that we can aware that someone is working on it. Please update status asap.

[crazywoola]

Yes we do have someone looking into it. and where did you send it to? security@dify.ai ?

[zn9988]

Hi @crazywoola , Thanks for prompt response. I actually submitted via your GitHub Security Advisory. Could you please check whether you have access it https://github.com/langgenius/dify/security/advisories/GHSA-jhgq-cx3f-vj5p. If yes please have acknowledged on the advisory that you are looking into it. I will be going to submit a another. We hope our research help to improve security of the DIFY as well as help users stay informed and avoid potential security risk.

[zn9988]

HI @crazywoola, I have submitted two more reports but haven't got any response from you. I tried to follow up with the provided email security@dify.ai but the email seems no existing. Could you please get back to me asap at least a acknowledgment for receiving the reports

[zn9988]

@crazywoola Any updates on this? it has been almost a weeks. I have submitted the other security advisory last week.

https://github.com/langgenius/dify/security/advisories/GHSA-hqcx-598m-pjq4
https://github.com/langgenius/dify/security/advisories/GHSA-gg5w-m2vw-vmmj