FlowiseAI/Flowise
1
0
Fork 0
mirror of https://github.com/FlowiseAI/Flowise.git synced 2026-10-11 21:59:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(security): Sunset notice (#6692)

Browse Source 
* Update SECURITY.md

* Remove old information
This commit is contained in:
igor-magun-wd
2026-08-03 12:46:41 +08:00
committed by GitHub
parent fe285d0b8d
commit ba4c6509bb
1 changed files with 2 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+2 -87
View File
@@ -1,88 +1,3 @@
### Responsible Disclosure Policy
## ⚠️ IMPORTANT NOTICE: PRODUCT SUNSET ⚠️
At Flowise, we prioritize security and continuously work to safeguard our systems. However, vulnerabilities can still exist. If you identify a security issue, please report it to us so we can address it promptly. Your cooperation helps us better protect our platform and users.
### Scope
- Flowise Cloud: cloud.flowiseai.com
- Public Flowise Repositories
### Out of scope vulnerabilities
- Hypothetical issues that do not have a demonstrable, practical impact
- Vulnerabilities that affect out-of-date browsers
- ClickjackingCSRF on unauthenticated/logout/login pages
- Banner disclosure on common/public services
- Disclosure of known public files or directories (e.g. robots.txt)
- Attacks requiring MITM (Man-in-the-Middle) or physical device access
- Social engineering attacks
- Denial service via bruteforce attack
- Content spoofing and text injection without a valid attack vector
- Username enumeration via Login Page error message
- Username enumeration via Forgot password error message
- Bruteforce attacks
- Email spoofing
- Absence of DNSSEC, CAA, CSP headers
- Missing Secure or HTTP-only flag on non-sensitive cookies
- Deadlinks
- User enumeration
- Social Engineering
- Version Disclosure
- Vulnerabilities that can only affect the attacker (e.g. self-XSS)
- Known vulnerabilities in used libraries (unless exploitability can be proven)
- Static application security testing findings
### Reporting Guidelines
- Submit your findings to https://github.com/FlowiseAI/Flowise/security
- Provide clear details to help us reproduce and fix the issue quickly.
### Reporting Guidelines
- Submit your findings to https://github.com/FlowiseAI/Flowise/security
- Ensure that the vulnerability is exploitable. Theoretical or static application security testing reports are subject to dismissal.
- Submit the report with CVSS vector and calculated severity.
- Provide a clear detailed report with proof of concept to help us reproduce and remediate the vulnerability.
### Disclosure Terms
The Flowise team believes that transparency is important and public bug bounty reports are a valuable source of knowledge for bug bounty researchers. However, the Flowise team may have legitimate reasons not to disclose vulnerabilities.
Do not discuss or disclose vulnerability information without prior written consent. If you plan on presenting your research, please share a draft with us at least 45 days in advance for review. Avoid including:
- Data from any Flowise customer projects
- Flowise user/customer information
- Details about Flowise employees, contractors, or partners
### Report Validation Times
We will validate submissions within the below timelines.
| Vulnerability Severity | Time to Validate |
| ---------------------- | ---------------- |
| Critical | 5 business days |
| High | 5 business days |
| Medium | 15 business days |
| Low | 15 business days |
Your report will be kept _confidential_, and your details will not be shared without your consent. The Flowise team will triage and adjust severity or CVSS score if necessary.
We appreciate your efforts in helping us maintain a secure platform and look forward to working together to resolve any issues responsibly.
### Remediation
Once the report has been verified, the Flowise team will plan the remediation steps.
Below is the estimated time to remediate the triaged security reports.
| Triaged Severity | Estimated Time to Remediate |
| ---------------- | --------------------------- |
| Critical | 30 business days |
| High | 60 business days |
| Medium | 90 business days |
### Public Disclosure Timeline
Public Disclosure occurs exactly 30 days after the next official release that includes the security patch. This period gives Flowise users a time to adopt the patched version before technical vulnerability details are made public, mitigating the risk of immediate post-disclosure exploitation.
#### Reaching out to the Security team
To report a new vulnerability, please submit a GitHub Security Advisory report.
If you have any questions or concerns about the existing Security Advisory, please contact security-team@flowiseai.com.
Flowise is officially being sunset and will soon cease active maintenance or support. As a result, **we are no longer accepting new security vulnerability reports for this repository.** You can find more information [here](https://flowiseai.com/sunset).