fastapi-sso handles logins, so a bug here can become someone else's account takeover. Security reports are the most
useful thing you can send me, and they get priority over everything else in the tracker.
Fixes ship in a new release built from master. There are no maintenance branches and no backports, so only the
latest release receives security fixes.
| Version | Supported |
|---|---|
| Latest release | ✅ |
| Anything older | ❌ |
Upgrade to the latest release before reporting, so we don't spend time on something already fixed.
Report privately, not in the public issue tracker.
Use GitHub's private vulnerability reporting, which is enabled on this repository:
- Open Report a vulnerability.
- Describe the issue, the version you tested against, and the impact you think it has.
- Include steps to reproduce, ideally a short runnable snippet.
- Suggest a severity if you have one in mind. I may end up disagreeing, and that is a normal part of triage.
Only you and the maintainers can see the report. It stays private until an advisory is published.
If you have already opened a public issue before reading this, don't worry about it. Say so in the private report and I will handle the cleanup.
- An acknowledgement that I received the report.
- Triage, where I confirm or dispute the finding and we agree on severity.
- A fix, released as a new version.
- A published GitHub Security Advisory naming you as the reporter, unless you would rather stay anonymous.
- A CVE, requested through GitHub, for anything that affects users on the default configuration.
This is a side project maintained by one person, so response times depend on what else my week looks like. I would rather tell you that up front than promise a turnaround I cannot keep.
Disclosure is coordinated. The advisory goes public once the fixed version is on PyPI, so that everyone reading it has somewhere to upgrade to. Please hold off on publishing details until then.
If a fix is taking unreasonably long, tell me. Agreeing on a disclosure date is fair, going around me without saying anything is not.
Everything that is not a vulnerability belongs in the issue tracker,
including things you are annoyed about. If there is something concerning fastapi-sso you would like to bitch about,
let me know and we'll bitch about it together.
Reporting takes real effort and I appreciate every report I get, including the ones that turn out to be false alarms.