immich-app/.github
1
0
Fork 0
mirror of https://github.com/immich-app/.github.git synced 2026-09-30 13:23:01 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: inherit SECURITY.md from org-level .github repo

Browse Source
This commit is contained in:
immich-tofu[bot]
2026-07-27 17:12:43 +00:00
committed by GitHub
parent b9f4bc67c6
commit eee369a1a4
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+17 -1
View File
@@ -2,4 +2,20 @@
## Reporting a Vulnerability
Please report security issues to `security@immich.app`
Please report security issues via https://github.com/immich-app/immich/security/advisories/new or to `security@immich.app`
## Scope
The following are out of scope:
* Surrounding infrastructure (redis, postgres, admin additions like reverse proxy configuration): These are the admin's responsibility.
* Attacks that require an attacker to already be an authenticated administrator: The Immich admin is already the owner of the machine.
* Network access to immich-machine-learning: It should not be made accessible outside of the container network. An attack smuggled via immich-server is still in scope.
* Automated scanner output with no demonstrable impact.
* Login hardening features, specifically rate limiting and MFA: These should be delegated to an OAuth server.
* Resource exhaustion by an authenticated user through mechanisms that are normally expected to consume significant resources.
* Installations that don't use our official container images
## LLM-assisted reports
If you use an LLM to help find or describe an issue, you must confirm the behaviour yourself and include a tested step-by-step reproduction against a fresh Immich instance.