nprasad2077/MyIP

0 Fork 0

mirror of https://github.com/jason5ng32/MyIP.git synced 2026-11-04 08:55:47 +00:00

Files

T

jason5ng32andClaude Fable 5 9a534e6497 Docs(community): route security, conduct and support reports to the right channels

SECURITY.md used to ask for vulnerability reports in public issues while
requesting no public disclosure in the same breath; it now points at
GitHub's private advisory form, states the latest-release-only support
policy and scopes out non-code findings. The Code of Conduct's
enforcement contact — a literal blank since the file landed — now uses
the same private form. New SUPPORT.md and an issue-chooser config send
questions to Discussions Q&A and docs before they become issues, and
CONTRIBUTING drops its stale "questions also go to Issues" line.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-22 22:30:49 +08:00

1.9 KiB

Raw Blame History

Security Policy

Supported versions

Only the latest release gets security fixes. Older tags are not patched — if you self-host, upgrade before reporting.

Reporting a vulnerability

Report privately, not through a public issue. Use GitHub's private reporting form:

Report a vulnerability →

It's visible only to the maintainer, and it's the right channel even if you're unsure whether what you found is a real issue.

Helpful things to include:

What an attacker can do with it, and what they'd need to start (a session? just a URL?).
Steps to reproduce — a request, a payload, or a short script.
Where the problem lives: front-end (frontend/), API handler (api/), or shared code (common/).
Whether you hit it on ipcheck.ing or your own deployment, and the version if self-hosted.

What to expect

An acknowledgement within a few days.
A fix in the next release once it's confirmed, or an explanation if it turns out to be out of scope.
Credit in the release notes and the advisory, unless you'd rather stay anonymous.

Please hold off on public disclosure until a fix ships.

Out of scope

Findings against ipcheck.ing infrastructure rather than this codebase — rate limits, TLS configuration, DNS, hosting. Report those the same way, but they aren't code issues.
Third-party data providers. MyIP queries external IP-geolocation and network APIs; their vulnerabilities belong to them.
Automated scanner output with no working proof of concept.
Missing optional hardening in a self-hosted instance. ALLOWED_DOMAINS and the other environment settings are documented in the Developer Guide — an instance running without them is misconfigured, not vulnerable.