Security Policy
Supported versions
Only the latest major version released currently receives security updates. We strongly recommend upgrading to the newest release if you are on an older version.
Reporting a vulnerability
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests. Public disclosure before a fix is available can put users at risk. If you discover a security vulnerability, email a report to security <at> holodeck-b2b.org.
What to include in your report
To help us triage and resolve the issue quickly, please include:
- The specific version(s) of the software affected.
- A clear description of the vulnerability and its potential impact.
- Step-by-step instructions to reproduce the issue (including proof-of-concept code, if available).
We will respond within 72 hours and aim to fix critical issues as soon as possible. If the vulnerability is assessed to be actively exploited or poses a severe, unmitigated risk, we will notify the appropriate authorities (ENISA / CSIRT) within the legally required timelines.
Security Updates
Security advisories are published in the Security Advisories section of the project’s Github repository. Critical fixes are announced via GitHub Releases (with a [SECURITY] tag).