Security Advisories
Reporting a Vulnerability
Please report vulnerabilities privately, not in public issues, pull requests or discussions.
- Email: [email protected]
- GitHub: where a repository of the IronFlock organization shows Report a vulnerability under its Security tab, you can use GitHub’s private vulnerability reporting instead.
Please include the affected product, component and version, the steps to reproduce, the impact you expect, and how we can reach you. We confirm that we received your report within 5 working days, keep you informed, and agree a disclosure date with you.
The full policy, including testing guidelines, is the IronFlock security policy. The contact is also published in security.txt.
How Fixes Are Announced
Every IronFlock version comes with release notes. Security fixes are listed in their own Security section.
- Appliances: on the appliance, Profile → Instance License shows the release notes of every newer version below the update buttons. The owner of an appliance also gets an email for each new version, with its release notes. The email can be switched off in cloud Studio under Profile → Instances.
- IronFlock cloud: IronFlock updates the cloud itself; there is nothing to install.
When a vulnerability needs action from you, we also publish an advisory on this page: what is affected, how severe it is, which version fixes it, and what to do until you can update.
Published Advisories
No advisories have been published.