Security policy

Supported versions

Only the latest major version released of our products currently receives security updates, unless explicitly contractually agreed otherwise.
We strongly recommend upgrading to the newest release if you are on an older version.

Reporting a vulnerability

Please do not report security vulnerabilities through public GitHub issues, discussions, pull requests or other fora. Public disclosure before a fix is available can put users at risk.
If you discover a security vulnerability, email a report to security <at> chasquis-consulting.com.

What to include in your report

To help us triage and resolve the issue quickly, please include:

• The product name and specific version(s) of the software affected.
• A clear description of the vulnerability and its potential impact.
• Step-by-step instructions to reproduce the issue (including proof-of-concept code, if available).

We will respond within 72 hours and aim to fix critical issues as soon as possible.
If the vulnerability is assessed to be actively exploited or poses a severe, unmitigated risk, we will notify the appropriate authorities (ENISA / CSIRT) within the legally required timelines.

Security Updates

Security advisories on our open source software are published in the Security Advisories section of the project’s Github repository. Critical fixes are announced via GitHub Releases (with a [SECURITY] tag).
Security updates on non-open source software will be provided to customers with active Support & Maintenance contracts as soon as possible.