Currently, only the latest stable release of OpenCertServer is supported with security updates.
| Version | Supported | Security Updates |
|---|---|---|
| v1.0 (Current) | ✅ | ✅ |
| < v1.0 | ❌ | ❌ |
Please do not report security vulnerabilities via public GitHub issues. Publicly disclosing a vulnerability before a patch is available puts all users of the software at risk.
If you discover a potential security vulnerability in OpenCertServer, please report it privately to the maintainers.
- Send a message to the GitHub maintainers.
- Include a detailed description of the vulnerability.
- Provide a minimal reproducible example (PoC) if possible.
- Specify the version(s) of the software affected.
OpenCertServer follows the principle of Coordinated Vulnerability Disclosure. Our goal is to resolve security issues as quickly as possible while ensuring that users are protected.
- Private Notification: Once a report is received, we will acknowledge receipt within 3-5 business days.
- Triage and Fix: We will work to verify the issue and develop a patch. You will be kept informed of our progress.
- Public Disclosure: After a fix has been released and users are encouraged to update, we will coordinate with you to publish the details of the vulnerability (e.g., via a CVE or a security advisory).
We request that you do not disclose the vulnerability publicly until a patch is available and coordinated disclosure has occurred.
We value the help of the security community. Researchers who report vulnerabilities that lead to a fix will be credited in our release notes and/or a dedicated SECURITY_CREDITS.md file, provided they consent to being named.