2020-10-23 02:43:28 +02:00
|
|
|
# Security policy
|
2020-06-26 00:22:36 +02:00
|
|
|
|
|
|
|
|
Security announcements are sent to zulip-announce@googlegroups.com,
|
|
|
|
|
so you should subscribe if you are running Zulip in production.
|
|
|
|
|
|
2020-10-23 02:43:28 +02:00
|
|
|
## Reporting a vulnerability
|
2020-06-26 00:22:36 +02:00
|
|
|
|
|
|
|
|
We love responsible reports of (potential) security issues in Zulip,
|
|
|
|
|
whether in the latest release or our development branch.
|
|
|
|
|
|
|
|
|
|
Our security contact is security@zulip.com. Reporters should expect a
|
|
|
|
|
response within 24 hours.
|
|
|
|
|
|
|
|
|
|
Please include details on the issue and how you'd like to be credited
|
|
|
|
|
in our release notes when we publish the fix.
|
|
|
|
|
|
2021-05-05 01:39:27 +02:00
|
|
|
Our [security model][security-model] document may be a helpful
|
|
|
|
|
resource.
|
2020-06-26 00:22:36 +02:00
|
|
|
|
2020-10-23 02:43:28 +02:00
|
|
|
## Supported versions
|
2020-06-26 00:22:36 +02:00
|
|
|
|
|
|
|
|
Zulip provides security support for the latest major release, in the
|
|
|
|
|
form of minor security/maintenance releases.
|
|
|
|
|
|
2021-05-05 01:39:27 +02:00
|
|
|
We work hard to make [upgrades][upgrades] reliable, so that there's no
|
|
|
|
|
reason to run older major releases.
|
|
|
|
|
|
|
|
|
|
See also our documentation on the [Zulip release lifecycle][release-lifecycle]
|
|
|
|
|
|
|
|
|
|
[security-model]: https://zulip.readthedocs.io/en/latest/production/security-model.html
|
|
|
|
|
[upgrades]: https://zulip.readthedocs.io/en/latest/production/upgrade-or-modify.html#upgrading-to-a-release
|
|
|
|
|
[release-cycle]: https://zulip.readthedocs.io/en/latest/overview/release-lifecycle.html
|
