| description | How to report a security vulnerability in yarilo privately: supported versions, the GitHub reporting form or email, what to include, when you hear back, and no bounty program. |
|---|
Do not report security issues in public issues, pull requests or discussions. Report them privately, so the issue can be fixed before it is disclosed.
Security fixes go into the latest release of the current stable line (2.4.x). Upgrade to it before reporting.
Use one of these channels:
- the Report a vulnerability button on the repository's Security tab (preferred)
- email to [email protected]
Include the affected version, the relevant part of the configuration, steps to reproduce, and the impact you observed.
We acknowledge a report within 7 days.
There is no bounty program.
Published advisories and the full policy are at yarilomail.org/security.
Fixes with no advisory of their own are listed under Security in the release notes. In 2.4.4 that is #2297: require "ihave" bypassed the sieve_extensions whitelist, but only on installations that had added ihave to sieve_extensions; the default list does not include it.