3fa47f7031
- .github/workflows/ci.yml: TypeScript check + Vitest + build on every PR - .github/dependabot.yml: weekly npm + Actions updates (minor/patch grouped) - .github/ISSUE_TEMPLATE/: bug_report, feature_request, config (→ Discussions) - .github/PULL_REQUEST_TEMPLATE.md: checklist for contributors - SECURITY.md: responsible disclosure policy via GitHub Advisories - CONTRIBUTING.md: dev setup, code style, commit conventions
45 lines
1.3 KiB
Markdown
45 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Only the latest release on `main` is actively maintained.
|
|
|
|
| Version | Supported |
|
|
|---|---|
|
|
| `main` (latest) | ✅ |
|
|
| older commits | ❌ |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Please do not report security vulnerabilities through public GitHub Issues.**
|
|
|
|
Instead, use one of these private channels:
|
|
|
|
- **GitHub Security Advisories** (preferred): [Open a draft advisory](https://github.com/ralksta/immich-folio/security/advisories/new)
|
|
- **Email**: contact the maintainer via the email listed on the GitHub profile
|
|
|
|
### What to include
|
|
|
|
- Description of the vulnerability and potential impact
|
|
- Steps to reproduce (minimal reproduction if possible)
|
|
- Affected versions / configurations
|
|
- Any proposed fix or mitigation
|
|
|
|
### Response timeline
|
|
|
|
- **Acknowledgement**: within 48 hours
|
|
- **Triage & assessment**: within 7 days
|
|
- **Fix & coordinated disclosure**: within 30 days for critical issues
|
|
|
|
## Scope
|
|
|
|
immich-folio acts as a **reverse proxy** in front of your private Immich instance. Security issues in scope include:
|
|
|
|
- Authentication / session bypass
|
|
- API key / secret leakage
|
|
- XSS vulnerabilities in gallery pages or lightbox
|
|
- Rate-limiting bypass enabling DoS
|
|
- Insecure Docker defaults that expose the Immich backend
|
|
|
|
Out of scope: vulnerabilities in Immich itself (report those upstream at [immich.app](https://immich.app)).
|