FerrisKey is an Identity and Access Management system. A vulnerability in it can expose every application that relies on it, so reports are handled as a priority.

Do not open a public issue, pull request or Discord message for a vulnerability.

Report it through one of these private channels:

• Report a vulnerability in the Security tab of this repository (preferred).
• Email security@ferriskey.rs.

Include what you can of the following: a description of the problem, the affected versions, steps or a proof of concept that reproduce it, the impact you see, and any mitigation you know of.

The maintainers listed in MAINTAINERS.md handle the report. They may ask you for more details and will keep you informed of the progress.

Reports stay private until the fix is released or the 90-day deadline is reached, whichever comes first. Disclosure is coordinated with the reporter and may happen at the deadline even if no fix is available yet. If a vulnerability is already public or actively exploited, the fix and the advisory are published as soon as possible.

Advisories are published on the repository Security Advisories page. The maintainers request a CVE through GitHub when the advisory is eligible. Reporters are credited in the advisory unless they ask not to be.

FerrisKey is pre-1.0 and releases minor versions regularly. Security fixes are released in the latest minor version only. Upgrade to the latest release to receive them.

This policy covers the code in this repository: the API, the core domain, the web console, the operator, the Helm charts and the published container images. For a vulnerability in a dependency, report it to the dependency's maintainers first and tell us if FerrisKey is affected.