SECURITY

How to report security issues in AllArkive.

Reporting a vulnerability

Do not open a public GitHub issue for a security vulnerability.

Email: security@allarkive.org (placeholder — replace before v0.1) PGP key: see docs/security/pgp-key.txt (to be added)

Please include:

Acknowledgement within 5 business days.
Triage and initial assessment within 14 days.
Coordinated disclosure timeline agreed with you. Default target is 90 days from acknowledgement to public disclosure.
Credit in the release notes if you want it.

We're a two-person project. We can't promise enterprise SLAs. We will be responsive and honest about what we can and can't do.

Vulnerabilities in upstream projects (Kiwix, Ollama, Open WebUI). Report those upstream. We're happy to coordinate.
Vulnerabilities that require an attacker already on the host machine.
Vulnerabilities in user-modified deployments (changed bindings, custom reverse proxies, third-party bundles).
Self-XSS in the local landing page when the user pastes attacker-controlled content into their own browser.
Issues with services exposed to the public internet against our explicit recommendation. (We document not to do this. If you do it anyway, that's your threat model.)

Out of the box:

If you find something that weakens this posture by default, that's in scope.

We prefer coordinated disclosure with a reasonable embargo (default 90 days).
We will publish a security advisory in GitHub Security Advisories and link from CHANGELOG.md.
We will not pursue legal action against good-faith security research that follows this policy.

Once we have one. (empty for now)