CiviDash is currently developed on a single rolling branch (main). There are no
maintained long-term-support releases yet; security fixes are applied to main and to
the latest tagged release, if any.
| Version | Supported |
|---|---|
| main | ✅ |
| < main | ❌ |
A machine-readable version of this contact information lives in
public/.well-known/security.txt and is served at
/.well-known/security.txt on every deployment, per RFC 9116.
If you discover a security vulnerability in CiviDash, please do not open a public GitHub/GitLab issue. Instead, report it privately:
- Email:
support@janda-roscher.de
Please include:
- A description of the vulnerability and its potential impact
- Steps to reproduce (proof-of-concept code or requests, if applicable)
- Affected version/commit
- We aim to acknowledge new reports within 5 business days.
- We aim to provide an assessment and response within 30 days of acknowledgement.
- Confirmed vulnerabilities will be fixed and disclosed in coordination with the reporter; timelines depend on severity and complexity.
Please give us reasonable time to investigate and fix an issue before any public disclosure.