Sanaei
f727d04f65
CI / go-test (push) Canceled after 0s
CI / postgres-durable-first (push) Canceled after 0s
CI / codegen (push) Canceled after 0s
CI / govulncheck (push) Canceled after 0s
CI / race (push) Canceled after 0s
CI / fuzz-smoke (push) Canceled after 0s
CI / golangci (push) Canceled after 0s
CI / frontend (push) Canceled after 0s
CodeQL Advanced / Analyze (go) (push) Canceled after 0s
CodeQL Advanced / Analyze (actions) (push) Canceled after 0s
CodeQL Advanced / Analyze (javascript-typescript) (push) Canceled after 0s
Docs CI / build (push) Canceled after 0s
Docs Deploy (GitHub Pages) / build (push) Canceled after 0s
Release 3X-UI / build (386) (push) Canceled after 0s
Release 3X-UI / build (amd64) (push) Canceled after 0s
Release 3X-UI / build (arm64) (push) Canceled after 0s
Release 3X-UI / build (armv5) (push) Canceled after 0s
Release 3X-UI / build (armv6) (push) Canceled after 0s
Release 3X-UI / build (armv7) (push) Canceled after 0s
Release 3X-UI / build (s390x) (push) Canceled after 0s
Release 3X-UI / Build for Windows (amd64) (push) Canceled after 0s
Deploy Smoke Tests / noninteractive-install (ubuntu-24.04-arm) (push) Canceled after 0s
Deploy Smoke Tests / noninteractive-install (ubuntu-latest) (push) Canceled after 0s
Deploy Smoke Tests / release-tag-install (ubuntu-24.04-arm) (push) Canceled after 0s
Deploy Smoke Tests / release-tag-install (ubuntu-latest) (push) Canceled after 0s
Docs Deploy (GitHub Pages) / deploy (push) Canceled after 0s
Release 3X-UI / Publish rolling dev release (push) Canceled after 0s
23 lines
887 B
Markdown
23 lines
887 B
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public issue for anything you believe is exploitable — an
|
|
authentication bypass, remote code execution, injection, secret or
|
|
credential exposure, privilege escalation. A public report gives attackers
|
|
a head start against every 3x-ui deployment.
|
|
|
|
Instead, use GitHub's private vulnerability reporting: open this
|
|
repository's **Security** tab and click **Report a vulnerability**. Include
|
|
the affected 3x-ui version, reproduction steps, and the impact you see.
|
|
You will receive replies in the advisory thread.
|
|
|
|
There is no bug-bounty program. Fixes ship in the next release, and the
|
|
advisory is published after a fixed version is available.
|
|
|
|
## Supported versions
|
|
|
|
Only the latest release receives security fixes. Update with the install
|
|
script or your package channel and confirm the problem still exists before
|
|
reporting.
|