Please report security issues privately. Do not open a public issue, and do not include details in a pull request.
Use GitHub's private vulnerability reporting, which notifies the maintainers directly and keeps the discussion private until a fix ships. If you cannot use it, email [email protected] instead.
Helpful things to include, as far as you have them:
- the affected version or commit
- the endpoint, file, or flow involved
- what an attacker gains, and the minimum privilege they need to do it
- a proof of concept, if you have one
- An acknowledgement within 3 days.
- An assessment of severity and scope, and whether we can reproduce it, within 7 days.
- A fix released as soon as it is ready. Anything exploitable against a running instance is prioritised over other work.
- Credit in the advisory, unless you would rather stay anonymous.
We publish a GitHub Security Advisory for issues that affect self-hosted instances, so operators can see whether they are affected and what to do about it, including any credentials worth rotating.
Please give us a chance to ship a fix before disclosing publicly. If you have a deadline in mind, say so in your report and we will work to it.
Fixes land on the latest release. Self-hosted instances should track the most recent version; older versions do not receive backported patches.
| Version | Supported |
|---|---|
| Latest release | Yes |
| Older releases | No |
In scope: the API (apps/api), the web app (apps/web), the MCP server (packages/mcp), the Helm chart, and the published Docker images.
Out of scope: findings that require an already-compromised host or database, denial of service through sheer request volume, missing hardening headers with no demonstrated impact, and vulnerabilities in third-party dependencies without a working path through Kaneo. For dependency advisories, a pull request bumping the dependency is welcome and can be public.
Self-hosted deployments are configured by their operator. Reports that depend on an insecure configuration are useful when Kaneo's own defaults or documentation lead operators there; please say which default you followed.