Skip to main content
ReferenceDraft · not yet verified

Reporting a Vulnerability

Report a suspected vulnerability privately, through the Security tab of everythingmemory/home on GitHub. Reports reach the maintainers only.

How to report​

  1. Open everythingmemory/home on GitHub.
  2. Choose the Security tab, then Report a vulnerability.
  3. Describe what you found. The report is private: only the maintainers see it.

Please do not open a public issue, pull request or discussion for a suspected vulnerability.

What to include​

  • the release you tested (GET /health reports it as version);
  • the part affected: the engine, a plugin, the compose stack, the console, the bundle tool or Folder Intake;
  • the steps to reproduce it, and any settings it depends on (with secrets removed);
  • what an attacker gains, and from what starting point: no access, a client key, a peer key, or access to the host;
  • whether you have told anyone else.

What happens next​

We acknowledge the report, keep you informed while we investigate, and tell you when a fixed release is out. Please give us reasonable time to release a fix before you disclose the issue publicly.

There is no bug bounty programme.