From ba4c6509bbc481cc7f01aab3d1aa33a2aea886f1 Mon Sep 17 00:00:00 2001 From: igor-magun-wd Date: Mon, 3 Aug 2026 00:46:41 -0400 Subject: [PATCH] feat(security): Sunset notice (#6692) * Update SECURITY.md * Remove old information --- SECURITY.md | 89 ++--------------------------------------------------- 1 file changed, 2 insertions(+), 87 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index e607ed2fe..cebc4790e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,88 +1,3 @@ -### Responsible Disclosure Policy +## ⚠️ IMPORTANT NOTICE: PRODUCT SUNSET ⚠️ -At Flowise, we prioritize security and continuously work to safeguard our systems. However, vulnerabilities can still exist. If you identify a security issue, please report it to us so we can address it promptly. Your cooperation helps us better protect our platform and users. - -### Scope - -- Flowise Cloud: cloud.flowiseai.com -- Public Flowise Repositories - -### Out of scope vulnerabilities - -- Hypothetical issues that do not have a demonstrable, practical impact -- Vulnerabilities that affect out-of-date browsers -- ClickjackingCSRF on unauthenticated/logout/login pages -- Banner disclosure on common/public services -- Disclosure of known public files or directories (e.g. robots.txt) -- Attacks requiring MITM (Man-in-the-Middle) or physical device access -- Social engineering attacks -- Denial service via bruteforce attack -- Content spoofing and text injection without a valid attack vector -- Username enumeration via Login Page error message -- Username enumeration via Forgot password error message -- Bruteforce attacks -- Email spoofing -- Absence of DNSSEC, CAA, CSP headers -- Missing Secure or HTTP-only flag on non-sensitive cookies -- Deadlinks -- User enumeration -- Social Engineering -- Version Disclosure -- Vulnerabilities that can only affect the attacker (e.g. self-XSS) -- Known vulnerabilities in used libraries (unless exploitability can be proven) -- Static application security testing findings - -### Reporting Guidelines - -- Submit your findings to https://github.com/FlowiseAI/Flowise/security -- Provide clear details to help us reproduce and fix the issue quickly. - -### Reporting Guidelines - -- Submit your findings to https://github.com/FlowiseAI/Flowise/security -- Ensure that the vulnerability is exploitable. Theoretical or static application security testing reports are subject to dismissal. -- Submit the report with CVSS vector and calculated severity. -- Provide a clear detailed report with proof of concept to help us reproduce and remediate the vulnerability. - -### Disclosure Terms - -The Flowise team believes that transparency is important and public bug bounty reports are a valuable source of knowledge for bug bounty researchers. However, the Flowise team may have legitimate reasons not to disclose vulnerabilities. - -Do not discuss or disclose vulnerability information without prior written consent. If you plan on presenting your research, please share a draft with us at least 45 days in advance for review. Avoid including: - -- Data from any Flowise customer projects -- Flowise user/customer information -- Details about Flowise employees, contractors, or partners - -### Report Validation Times - -We will validate submissions within the below timelines. -| Vulnerability Severity | Time to Validate | -| ---------------------- | ---------------- | -| Critical | 5 business days | -| High | 5 business days | -| Medium | 15 business days | -| Low | 15 business days | - -Your report will be kept _confidential_, and your details will not be shared without your consent. The Flowise team will triage and adjust severity or CVSS score if necessary. -We appreciate your efforts in helping us maintain a secure platform and look forward to working together to resolve any issues responsibly. - -### Remediation - -Once the report has been verified, the Flowise team will plan the remediation steps. -Below is the estimated time to remediate the triaged security reports. - -| Triaged Severity | Estimated Time to Remediate | -| ---------------- | --------------------------- | -| Critical | 30 business days | -| High | 60 business days | -| Medium | 90 business days | - -### Public Disclosure Timeline - -Public Disclosure occurs exactly 30 days after the next official release that includes the security patch. This period gives Flowise users a time to adopt the patched version before technical vulnerability details are made public, mitigating the risk of immediate post-disclosure exploitation. - -#### Reaching out to the Security team - -To report a new vulnerability, please submit a GitHub Security Advisory report. -If you have any questions or concerns about the existing Security Advisory, please contact security-team@flowiseai.com. +Flowise is officially being sunset and will soon cease active maintenance or support. As a result, **we are no longer accepting new security vulnerability reports for this repository.** You can find more information [here](https://flowiseai.com/sunset).