immich-app/devtools
1
0
Fork 0
mirror of https://github.com/immich-app/devtools.git synced 2026-09-30 13:23:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add scope to security policy (#1855)

Browse Source
This commit is contained in:
bo0tzz
2026-07-27 19:11:30 +02:00
committed by GitHub
parent ca2f3b9c18
commit 7d09367b03
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md
+17 -1
View File
@@ -2,4 +2,20 @@
## Reporting a Vulnerability ## Reporting a Vulnerability
Please report security issues to `security@immich.app` Please report security issues via https://github.com/immich-app/immich/security/advisories/new or to `security@immich.app`
## Scope
The following are out of scope:
* Surrounding infrastructure (redis, postgres, admin additions like reverse proxy configuration): These are the admin's responsibility.
* Attacks that require an attacker to already be an authenticated administrator: The Immich admin is already the owner of the machine.
* Network access to immich-machine-learning: It should not be made accessible outside of the container network. An attack smuggled via immich-server is still in scope.
* Automated scanner output with no demonstrable impact.
* Login hardening features, specifically rate limiting and MFA: These should be delegated to an OAuth server.
* Resource exhaustion by an authenticated user through mechanisms that are normally expected to consume significant resources.
* Installations that don't use our official container images
## LLM-assisted reports
If you use an LLM to help find or describe an issue, you must confirm the behaviour yourself and include a tested step-by-step reproduction against a fresh Immich instance.