Thank you for helping keep Revula secure.

We take the security of this project seriously and appreciate responsible disclosure of potential vulnerabilities.

Security updates are provided for the latest stable release.

If you discover a vulnerability affecting an older version, please verify whether it also exists in the latest release before reporting it.

Please do not report security vulnerabilities through public GitHub Issues or Discussions.

Instead, use GitHub's Report a Vulnerability feature available in the repository's Security tab.

When submitting a report, please include as much information as possible:

• A clear description of the vulnerability.
• The affected version or commit.
• Steps to reproduce the issue.
• Proof of concept (PoC), if available.
• The potential impact of the vulnerability.
• Any suggested remediation, if applicable.

After receiving your report, we aim to:

• Acknowledge receipt within 72 hours.
• Assess and triage the report.
• Keep you informed of the investigation and remediation progress.
• Release a fix as quickly as practical, depending on the severity and complexity of the issue.

Valid reports will receive appropriate credit unless you prefer to remain anonymous.

Examples of vulnerabilities that are generally considered in scope include:

• Authentication and authorization bypasses
• Remote code execution (RCE)
• SQL injection
• Command injection
• Cross-site scripting (XSS)
• Server-side request forgery (SSRF)
• Cross-site request forgery (CSRF)
• Path traversal
• Insecure deserialization
• Sensitive data exposure
• Privilege escalation
• Business logic vulnerabilities
• Security misconfigurations
• Denial-of-service vulnerabilities that have a practical impact

The following are generally considered out of scope unless they have a significant security impact:

• Requests for new features
• Missing security headers without demonstrated impact
• Self-XSS
• Social engineering attacks
• Physical attacks
• Vulnerabilities in third-party services that are outside this project's control
• Reports without sufficient information to reproduce the issue

Please allow us reasonable time to investigate and address reported vulnerabilities before publicly disclosing them.

We are committed to working collaboratively with security researchers to resolve legitimate security issues and improve the security of Revula.

Thank you for helping make Revula more secure.