Security policy? #846

New Issue

andreymal · 2021-04-22T12:45:20Z

andreymal commented

2021-04-22 12:45:20 +00:00

I found a way to read private tasks without proper authorization (successfully tested on my.vikunja.cloud), but I'm not sure that Gitea issues is a good place to provide details. Is there a private email or something to send a security issue?

konrad commented

2021-04-22 12:56:37 +00:00

You can contact me on security@vikunja.io with this pgp key or on matrix (@kolaente:matrix.org) with encryption through element.

You can contact me on security@vikunja.io with [this pgp key](http://keyserver.ubuntu.com/pks/lookup?search=security%40vikunja.io&fingerprint=on&op=index) or on matrix (@kolaente:matrix.org) with encryption through element.

andreymal commented

2021-04-22 13:03:09 +00:00

Oh, I didn't notice that this is on the contact page https://vikunja.io/contact/

I think it would be better to duplicate this in a more prominent place, maybe in README or issue template

Oh, I didn't notice that this is on the contact page https://vikunja.io/contact/ I think it would be better to duplicate this in a more prominent place, maybe in README or issue template

andreymal closed this issue

2021-04-22 13:03:09 +00:00

konrad commented

2021-04-22 13:03:46 +00:00

Yeah, I think that's a good idea.