This document describes how to report security vulnerabilities for Smart EDMS. For the security model and controls, see docs/SECURITY.md.
| Version | Supported |
|---|---|
| 1.0.x | ✅ |
| < 1.0 | ❌ |
Do NOT open a public GitHub issue for security vulnerabilities.
If you discover a security vulnerability in Smart EDMS:
- Email: security@smart-edms.example
- Subject:
[SECURITY] <brief description> - Include:
- Description of the vulnerability
- Steps to reproduce (proof of concept if possible)
- Affected versions
- Potential impact
- Suggested fix (if any)
- Your name/handle for credit (optional)
| Step | Target |
|---|---|
| Acknowledgment of receipt | 48 hours |
| Initial assessment | 7 days |
| Fix timeline communication | 14 days |
| Fix release (severity-dependent) | 30-90 days |
- We will acknowledge your report within 48 hours.
- We will investigate and verify the vulnerability.
- We will work with you to understand the impact and develop a fix.
- We will credit you in the security advisory (unless you prefer to remain anonymous).
- We will coordinate disclosure timing with you.
- Do not publicly disclose the vulnerability until a fix is released.
- Do not access or modify data that does not belong to you.
- Do not degrade service availability (no DoS testing on production systems).
- Do provide sufficient detail for us to reproduce and fix the issue.
- Smart EDMS backend (
apps/backend) - Smart EDMS Electron client (
apps/electron) - Smart EDMS Licensing Server (
apps/license-server) - Smart EDMS License Admin Panel (
apps/license-admin) - Smart EDMS Marketing Page (
apps/marketing) - Shared packages (
packages/*)
- Third-party dependencies (report to the respective maintainer)
- Self-hosted infrastructure misconfiguration (e.g., exposed database ports)
- Social engineering attacks
- Physical security attacks
- Denial of service attacks on production systems
- Vulnerabilities requiring physical access to a user's device
Smart EDMS implements defense-in-depth security. See:
- Security Model — full security architecture
- Threat Model — STRIDE analysis
- Security Controls Matrix — 59 controls mapped to threats
- Architecture Decision Records — security-related design decisions
We do not currently operate a formal bug bounty program. However, we sincerely appreciate responsible disclosure and will acknowledge contributors in our security advisories.
- Security email: security@smart-edms.example
- PGP key: (coming soon — will be published at https://smart-edms.example/.well-known/security.txt)
- General support: see SUPPORT.md