Skip to content

Security: Colin955023/MinecraftServerManager

.github/SECURITY.md

安全通報

只支援最新版本。請透過 GitHub Security Advisory 私下回報;修補發布前不要在 Issue、Discussion 或 PR 公開漏洞或 POC。

請提供:

  • 受影響版本與功能
  • 最小重現步驟
  • 影響與錯誤資訊
  • 可行的修補或緩解方式(選填)

範圍包括任意檔案存取、路徑穿越、命令注入、敏感資料洩漏、遠端程式碼執行與權限繞過。

目標時程:7 天內確認、14 天內初步評估、有效漏洞通常在 60 天內修補。若已遭利用或需要更多時間,會在 Advisory 提供狀態與暫行措施。


Vulnerability Reporting

Supported Versions

Only the latest release of Minecraft Server Manager is actively supported with security updates.

Reporting a Vulnerability

Please report potential security vulnerabilities privately via GitHub Security Advisories. Do not disclose vulnerabilities, reproduction steps, or proof-of-concept exploits publicly in issues, discussions, or pull requests prior to an official coordinated release.

Please include the following details in your advisory:

  • Affected component and version
  • Clear step-by-step instructions to reproduce the issue
  • Impact assessment and error logs (if any)
  • Suggested fix or mitigation (optional)

In-scope security topics include arbitrary file access, path traversal, command injection, sensitive data leakage, remote code execution, and authorization bypass.

Coordinated Disclosure and Response Timeline

  • Initial Acknowledgment: Within 7 business days
  • Severity & Impact Assessment: Within 14 business days
  • Remediation & Patch Release: Validated vulnerabilities are typically patched within 60 days
  • Status Updates: Progress and mitigation workarounds will be communicated through the private advisory.

There aren't any published security advisories