Security fixes are made for the latest release and for traewelling.de only.
Please do not report vulnerabilities in public issues, discussions or pull requests.
Report them privately instead:
- via Report a vulnerability on GitHub, or
- by email to security@traewelling.de, optionally encrypted with our PGP key
(
355E 606E EC02 3E36 FE18 BD15 64D8 80FA CBED 8D11).
Please include:
- the affected URL, endpoint or file
- steps to reproduce
- the impact
- the version or commit you tested
We reply within 7 days. Träwelling is maintained by volunteers, so a fix may take longer.
We coordinate the fix and its disclosure in a GitHub security advisory. You are credited in the advisory unless you prefer not to be.
In scope:
- the code in this repository
- traewelling.de
Out of scope:
- third party services such as Transitous or Mastodon instances
- denial of service, spam and rate limits
- social engineering
- reports from automated scanners without a demonstrated impact
- Use only your own accounts.
- Do not access, modify or delete data of other users.
- Do not put load on traewelling.de.