Project · Arion
Security policy
How to report a security issue in Arion and how reports are handled.
Arion sits on the request path of the systems it fronts, so we take security reports seriously and handle them privately.
Report a vulnerability
If you believe you have found a security vulnerability in Arion, report it through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability, or go straight to the report form. The report is visible only to the maintainers.
Never report a suspected vulnerability in a public issue, discussion or pull request. If you are unsure whether something is a security issue, report it privately anyway — we would rather triage a false alarm than read a vulnerability in the issue tracker.
What to include
The same qualities that make a good bug report make a good security report:
- The Arion version or commit, and the deployment mode
- The smallest configuration that exhibits the problem, sanitised
- What an attacker can do: the impact as you understand it
- Steps to reproduce, or a proof of concept if you have one
What to expect
We are a small team and respond on a best-effort basis. We read every report, acknowledge it as quickly as we can, and keep you updated while we assess it. For a confirmed vulnerability we develop and release a fix, publish a GitHub security advisory — with a CVE where warranted — and credit you in it, unless you prefer otherwise.
Coordinated disclosure
We ask you to keep the details of a report private until a fix is released and the advisory is published. We will work with you on the timing, and we will not take action against good-faith research conducted under this policy.
Scope
This policy covers the Arion codebase; fixes land in the latest release. Problems with this website are not security reports — an ordinary issue is the right place for those.