Reporting Security Issues

fragicide

Is there an email or form where one can report security issues with Flarum? There are times where such issues should not be reported publicly, for obvious reasons. This post isn't to say that I have found an issue, but rather asking in the event that I, or someone else, does 🙂

Thanks.

luceos

fragicide I recommend coming on gitter: https://gitter.im/flarum/flarum and either talk to one of the mods (@Dominion or me) or the core devs (@Toby, @Franz) in private, we prefer the first to keep unwanted support load from the devs;

@Dominion is @dcsjapan on gitter
@luceos is @luceos on gitter

fragicide

Good to know.

Just a suggestion, but it would be easier to have a dedicated email address or report form for the handling of security reports, rather than a chat client. But that's just me 🙂

Thanks for your time!

luceos

We'll be working on that as soon as possible, I understand such a channel would be highly recommended. As soon as we have a formal method of reporting such critical issues, we'll update the documentation and the "report a bug" page.

fragicide

Awesome! Thanks again.

luceos

fragicide it's possible to report security issues at security@flarum.org now. We will update related pages as soon as sanely possible.