MHSanaei
8fe7be943f
GitHub private reporting stays the primary channel. The address gives reporters without GitHub a private route and matches the primary_contact used for the OSS Scanner enrolment, which checks SECURITY.md for it.
1.0 KiB
Security Policy
Reporting a vulnerability
Do not open a public issue for anything you believe is exploitable — an authentication bypass, remote code execution, injection, secret or credential exposure, privilege escalation. A public report gives attackers a head start against every 3x-ui deployment.
Instead, use GitHub's private vulnerability reporting: open this repository's Security tab and click Report a vulnerability. Include the affected 3x-ui version, reproduction steps, and the impact you see. You will receive replies in the advisory thread.
If you cannot use GitHub's private reporting, email the security contact at ho3ein.sanaei@gmail.com. Automated reports from Anthropic's OSS Scanner also go to this address.
There is no bug-bounty program. Fixes ship in the next release, and the advisory is published after a fixed version is available.
Supported versions
Only the latest release receives security fixes. Update with the install script or your package channel and confirm the problem still exists before reporting.