tcms/SECURITY.md

Security Policy

Reporting a Vulnerability

If you believe you have found a security vulnerability in Bludit, please do not open a public GitHub issue, post in discussions, or disclose it on social media before it has been addressed.

Instead, report it privately through GitHub's Private Vulnerability Reporting:

https://github.com/bludit/bludit/security/advisories/new

This opens a private advisory visible only to the Bludit maintainers.

When reporting, please include:

• A clear description of the vulnerability and its impact.
• Steps to reproduce, including a proof of concept if possible.
• The Bludit version, PHP version, and webserver where you reproduced it.
• Any suggested mitigation or patch.

What to Expect

• We aim to acknowledge new reports within 5 business days.
• We will keep you informed as we investigate and work on a fix.
• Once a fix is released, we will publish a GitHub Security Advisory crediting the reporter (unless you prefer to remain anonymous) and, where appropriate, request a CVE.

Supported Versions

Security fixes are provided for the latest stable release of Bludit on the master branch. Older versions are not supported — please upgrade before reporting issues against them.

Scope

In scope:

• The Bludit core (bl-kernel/, bl-plugins/ shipped with core, bl-themes/ shipped with core).
• The official admin interface.

Out of scope:

• Third-party plugins and themes not maintained in this repository.
• Issues that require an already-compromised admin account or server.
• Denial of service, rate-limiting, and brute-force concerns — these should be handled at the infrastructure layer (reverse proxy / WAF / Cloudflare).
• Self-XSS, missing security headers without a demonstrated impact, and other best-practice findings without a concrete exploit.

Thank you for helping keep Bludit and its users safe.