At CAOS we are extremely grateful for security aware people who disclose vulnerabilities to us and the open source community. All reports will be investigated by our team.
| Version | Supported |
|---|---|
| 1.x.x | ✅ |
| 0.x.x | ❌ |
To file an incident, please disclose it by e-mail to [email protected] including the details of the vulnerability.
At the moment GPG encryption is no yet supported, however you may sign your message at will.
- You think you discovered a
- potential security vulnerability in
ZITADEL - vulnerability in another project that
ZITADELis based on
- potential security vulnerability in
- For projects with their own vulnerability reporting and disclosure process, please report it directly there
- You need help applying security related updates
- Your issue is not security related
TBD
All accepted and mitigated vulnerabilities will be published on ZITADEL's GitHub Security Page.
We think it is crucial to publish advisories ASAP as mitigations are ready. But due to the unknown nature of the discloures the time frame can range from 7 to 90 days.