Please tell us privately, never in public issues or Discussions:
- through this repository's GitHub security advisories: Security, then Report a vulnerability; or
- by email to security@guildnet.chat.
Say what you found, how to reproduce it, and what someone could do with it. If it's in the web chat, report it here too: the chat is guildnet-chat, and it's the same people.
GuildNet is looked after by a small team, so these are times we can keep:
| Within | |
|---|---|
| We say we've got your report | 3 working days |
| We tell you what we make of it | 10 working days |
| A fix for something critical (anyone can take over an install, read another network's data, or get out of a desk) | 14 days |
| A fix for anything else that matters | 30 days, or the next release |
We'll keep you posted while we work on it, agree with you when it's made public (within 90 days of your report, sooner once a fix is out), and thank you by name in the release notes and the advisory, if you'd like.
There's no bug bounty.
The latest release. Fixes go into a new release, not old ones: upgrading is in docs/self-host/operations.md.
Test against an install of your own. Don't test against anyone else's, including networks on guildnet.chat: if you find a problem that reaches guildnet.chat, report it, but don't use it to see or change anyone's data, and don't try to slow the service down. If you keep to that and tell us first, we won't hold your research against you.
What GuildNet protects, and what it leaves to you, is in docs/self-host/security.md.