Security matters for Ogoune. 🔒 Thank you for helping keep it and its users safe.

Ogoune is currently in beta. Security fixes are provided for the latest released version only.

Once a stable line ships, this table will list the supported minor versions.

Please do not open a public issue for security problems.

Report privately through either channel — GitHub is preferred because it gives us a private, trackable thread and a path to a coordinated advisory (and, if warranted, a CVE):

1. GitHub Security Advisory (preferred) — open a private report at github.com/denisakp/ogoune/security/advisories/new.
2. Email (fallback) — security@ogoune.com.

Even if you are unsure whether the issue is real, report it anyway.

• A clear description of the vulnerability and its impact.
• Steps to reproduce (proof-of-concept code, requests, or configuration).
• Affected version / commit and deployment mode (Community SQLite or Postgres + Redis).
• Any suggested remediation, if you have one.

• Acknowledgement within 3 business days.
• Initial assessment (severity + whether we can reproduce) within 7 business days.
• We work on a fix and keep you updated on progress. Once released, we publish an advisory crediting you (unless you prefer to stay anonymous).

Please give us a reasonable window to release a fix before any public disclosure — up to 90 days, or until a fix ships, whichever comes first. We are happy to coordinate timing and credit with you.

We consider good-faith security research conducted under this policy to be authorized. We will not pursue or support legal action against researchers who report vulnerabilities responsibly, avoid privacy violations and service disruption, and give us reasonable time to respond before disclosing.

Thanks for your help 🙇