Reporting a vulnerability¶
PEART is a security tool that hosts third parties' vulnerability data. Reports are taken seriously and
answered quickly. The authoritative policy is SECURITY.md in the repository; this is its reader-facing
summary.
How to report¶
Use GitHub's private security advisory channel, Security → Report a vulnerability, on the
repository. If you prefer email, write to mentesan@gmail.com.
Do not open a public issue for a vulnerability. Reports are not discussed publicly before a fix is available. Include, as far as you can, the affected version, a description of the impact, reproduction steps, and the worst realistic consequence you see. A proof of concept helps but is not required.
What to expect¶
| Step | Target |
|---|---|
| Acknowledgement of receipt | 3 business days |
| Initial assessment and triage | 10 business days |
| Fix, or a fix plan with a date | 45 calendar days |
| Coordinated public disclosure | After the fix is available |
If you do not hear back within the acknowledgement window, follow up through the other channel before considering unilateral disclosure. A published advisory accompanies every fixed vulnerability that affected a released version, and the reporter is credited unless they ask otherwise; a CVE is requested for vulnerabilities with real security impact on a released version.
Scope¶
In scope: any flaw in this repository's code, in the published deploy artifacts, or in the default configuration the project ships.
Out of scope, because they are limitations declared in docs/security.md section 13: the database
being cleartext, with host disk encryption left to the operator; the system not defending against the
host operator or the installation administrator; the absence of volumetric denial-of-service protection,
which belongs to the reverse proxy and the infrastructure; operating-system, TLS, firewall and network
hardening; and the behaviour of an installation that disabled default controls by explicit
configuration. A report showing that one of these is worse than declared is welcome, and is treated at
least as a documentation failure.