BookStackApp/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-10-12 02:01:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Meta: Updated security docs with CRA and announcement info

Browse Source
This commit is contained in:
Dan Brown
2026-10-09 09:27:44 +01:00
parent ff661b59f6
commit 241a7018e5
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.forgejo/SECURITY.md
+18 -3
View File
@@ -12,11 +12,11 @@ If you'd like to be notified of new potential security concerns, you can [sign-u
## Reporting a Vulnerability
If you've found an issue that likely has no impact on existing users (For example, an issue only in the development branch)
If you've found an issue that likely has no impact on existing users (for example, an issue only in the development branch)
feel free to raise it via a standard Codeberg bug report issue.
If the issue could have a security impact on BookStack instances,
please directly contact the lead maintainer via email Dan Brown using the [details found here](https://www.bookstackapp.com/links/contact/).
please directly contact the lead maintainer, Dan Brown, via email using the [details found here](https://www.bookstackapp.com/links/contact/).
When contacting us, please note any names (and optionally any profile/company/website links) that you'd like to be used in
any attribution within our release notes and content.
@@ -36,4 +36,19 @@ and reported by someone else.
We can raise CVEs ourselves, but we would only go to the effort for security issues with a significant level of risk to users.
We typically won't pursue CVEs if there's a lesser level of risk.
_Note: Our reporting may change as the Cyber Resilience Act comes into effect._
### Our Announcement Channels
When security issues meet a reasonable level of risk to users, they will be assigned to be addressed via a BookStack "Security Release". When made available, these releases will be announced via our [security mailing list](https://updates.bookstackapp.com/signup/bookstack-security-updates), as a post on [our blog](https://www.bookstackapp.com/blog/), and security notices will be added to our [updates documentation page](https://www.bookstackapp.com/docs/admin/updates/#version-specific-instructions). These releases will also be typically announced in some of our social communities.
To meet the "reasonable level of risk" for a security release, the issue(s) will typically need to pose a risk to instance/user data and security. Security *improvements* (for example, hardening against denial of service attacks) typically won't trigger a security release by themselves, and may be released as a standard patch release.
CVEs may also be created for security issues, but this is not assured. We only seek CVEs for high-risk issues, although we're very liberal in allowing security researchers to report lesser issues also.
### CRA Reporting
In line with the [Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act), we aim to meet certain levels of reporting requirements by reporting the following to the relevant ENISA established single reporting platform:
- Actively exploited vulnerabilities contained in BookStack, when made aware of such exploit use.
- Severe incidents having an impact on the security of the product (for example, compromised BookStack infrastructure).