This repository is part of ReCasaOS, a maintained distribution of CasaOS. Only its latest release receives fixes; the installer, run again, or the update button of the dashboard moves a box to it.

Please do not open a public issue for a vulnerability.

Use GitHub's private report: on this repository, Security > Report a vulnerability. It reaches the maintainer only, and a fix and an advisory can be prepared in private. This applies to every component of the distribution (the installer, the dashboard, the gateway, the user, app management, storage and message bus services): report it here and say which one is affected.

A vulnerability in IceWhale's own releases, or in a CasaOS install that does not come from a ReCasaOS release, is theirs to fix: report it to them, at the address in their repository.