mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-10-13 01:14:59 +03:00
MHSanaei
8fe7be943f
GitHub private reporting stays the primary channel. The address gives reporters without GitHub a private route and matches the primary_contact used for the OSS Scanner enrolment, which checks SECURITY.md for it.
27 lines
1.0 KiB
Markdown
27 lines
1.0 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public issue for anything you believe is exploitable — an
|
|
authentication bypass, remote code execution, injection, secret or
|
|
credential exposure, privilege escalation. A public report gives attackers
|
|
a head start against every 3x-ui deployment.
|
|
|
|
Instead, use GitHub's private vulnerability reporting: open this
|
|
repository's **Security** tab and click **Report a vulnerability**. Include
|
|
the affected 3x-ui version, reproduction steps, and the impact you see.
|
|
You will receive replies in the advisory thread.
|
|
|
|
If you cannot use GitHub's private reporting, email the security contact
|
|
at ho3ein.sanaei@gmail.com. Automated reports from Anthropic's OSS Scanner
|
|
also go to this address.
|
|
|
|
There is no bug-bounty program. Fixes ship in the next release, and the
|
|
advisory is published after a fixed version is available.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release receives security fixes. Update with the install
|
|
script or your package channel and confirm the problem still exists before
|
|
reporting.
|