7cc7e6b4f3
Some checks failed
Test / Test on PHP 8.3 (push) Failing after 5s
Test / Test on PHP 8.4 (push) Failing after 4s
Test / Test on PHP 8.5 (push) Failing after 3s
TypeScript static analysis / TypeScript check (push) Failing after 14s
Test Integration on MySQL / Test on PHP 8.3 (push) Failing after 1s
Test Integration on MySQL / Test on PHP 8.5 (push) Failing after 1s
Test Integration on PostgreSQL / Test on PHP 8.4 fix (push) Failing after 1s
Test Integration on PostgreSQL / Test on PHP 8.4 master (push) Failing after 1s
16 lines
797 B
Markdown
16 lines
797 B
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
If you believe you have discovered a vulnerability in EspoCRM, please contact us via [this](https://www.espocrm.com/contacts/) or [this](https://www.espocrm.com/support/) forms. Or create a private vulnerability report on GitHub.
|
|
|
|
What reports we do not accept:
|
|
|
|
- Executing PHP code by an extension, during extension installation or upgrade process.
|
|
- Exposing contacts through a target list, campaign or mass email features, considering the user has access to these features.
|
|
- SSRF in IMAP/SMTP with TOCTOU.
|
|
|
|
Submitting multiple unverified reports without a proper proof of concept
|
|
(for example, by simply copy-pasting LLM-generated output) may be considered abuse of the reporting process
|
|
and may result in the reporting account being blocked.
|