diffinery/SECURITY.md
| 1 | # Security policy |
| 2 | |
| 3 | Thank you for helping keep Diffinery and the people who use it safe. |
| 4 | |
| 5 | ## Reporting a vulnerability |
| 6 | |
| 7 | **Please don't report security problems in public issues, pull requests or discussions.** |
| 8 | |
| 9 | Report them privately through the form at |
| 10 | [diffinery.com/security/report](https://diffinery.com/security/report). You don't need an |
| 11 | account. Only the maintainers can read what you send, and the form gives you a reference |
| 12 | number to quote if you write again. Every Diffinery instance serves its own |
| 13 | [`/.well-known/security.txt`](https://diffinery.com/.well-known/security.txt) with the same |
| 14 | form as its first contact. |
| 15 | |
| 16 | A good report says what is affected (a URL, API endpoint, git or MCP operation, CLI |
| 17 | command or file in this repository), the steps or a short script that reproduce it, what |
| 18 | an attacker could do with it, and when you would like to publish. |
| 19 | |
| 20 | The full policy, including what is in scope, safe harbour for good-faith research and the |
| 21 | response times we aim for, is at |
| 22 | [diffinery.com/docs/security/disclosure](https://diffinery.com/docs/security/disclosure). |
| 23 | |
| 24 | ## Supported versions |
| 25 | |
| 26 | Diffinery is deployed continuously from `main`, and only the latest `main` gets security |
| 27 | fixes. If you run your own instance, update it regularly (re-run `scripts/setup.sh` or |
| 28 | your Deploy workflow); see |
| 29 | [Updating](https://diffinery.com/docs/self-hosting/deploy#updating). |
| 30 | |
| 31 | ## Instances you don't run |
| 32 | |
| 33 | A problem in Diffinery's code should be reported here, even if you found it on someone |
| 34 | else's instance. Only test on an instance you run yourself or have permission to test. |
| 35 | Problems in Cloudflare's platform go to [Cloudflare](https://www.cloudflare.com/disclosure/). |