From 65628bb5491a2953371f921685fa19365db73086 Mon Sep 17 00:00:00 2001 From: Gary Date: Wed, 7 Oct 2026 19:50:46 +0200 Subject: [PATCH] docs(security): send vulnerability reports to this project, not to IceWhale SECURITY.md was still IceWhale's: it asked for reports at wiki@casaos.io, so a vulnerability in a ReCasaOS release would have gone to a project that does not ship it. It now points at GitHub's private report on this repository, and says what is and is not covered. --- SECURITY.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index a59b9591..9d5c6e01 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,9 +1,13 @@ # Security Policy -## Supported Versions +## Supported versions -CasaOS is currently under active development. Support is limited before CasaOS reaches v1.0. +This repository is part of [ReCasaOS](https://github.com/ReCasaOS/CasaOS-Install), a maintained distribution of CasaOS. Only its latest release receives fixes; the installer, run again, or the update button of the dashboard moves a box to it. -## Reporting a Vulnerability +## Reporting a vulnerability -If you see any vulnerabiility, email us at wiki@casaos.io +Please do not open a public issue for a vulnerability. + +Use GitHub's private report: on this repository, **Security > Report a vulnerability**. It reaches the maintainer only, and a fix and an advisory can be prepared in private. This applies to every component of the distribution (the installer, the dashboard, the gateway, the user, app management, storage and message bus services): report it here and say which one is affected. + +A vulnerability in IceWhale's own releases, or in a CasaOS install that does not come from a ReCasaOS release, is theirs to fix: report it to them, at the address in their repository.