Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
Mirrored from https://github.com/Slazee/caddy.git
Synced Nov 11, 14:45 UTC
Update SECURITY.md
Simplify what versions are supported, clarify our policy for unreleased code (or beta code), and expand our AI policy to require a disclosure in ALL cases, even if AI is not used. As well as an invitation to share in some chocolate milk with us if you're human.
Matt Holt committed
Mar 4, 2026 at 16:16 UTC
e06dfcf6ed3a8e7b07540751ce4391cb1743337d
1 file changed
+8
-7
.github/SECURITY.md
+8
-7
@@ -1,15 +1,14 @@
1
# Security Policy
2
3
-The Caddy project would like to make sure that it stays on top of all practically-exploitable vulnerabilities.
3
+The Caddy project would like to make sure that it stays on top of all relevant and practically-exploitable vulnerabilities.
4
5
6
## Supported Versions
7
8
-| Version | Supported |
9
-| -------- | ----------|
10
-| 2.latest | ✔️ |
11
-| 1.x | :x: |
12
-| < 1.x | :x: |
8
+| Version | Supported |
9
+| ----------- | ----------|
10
+| 2.latest | ✔️ |
11
+| <= 2.latest | :x: |
12
13
14
## Acceptable Scope
@@ -26,6 +25,8 @@ Client-side exploits are out of scope. In other words, it is not a bug in Caddy
25
26
Security bugs in code dependencies (including Go's standard library) are out of scope. Instead, if a dependency has patched a relevant security bug, please feel free to open a public issue or pull request to update that dependency in our code.
27
28
+We accept security reports and patches, but do not assign CVEs, for code that has not been released with a non-prerelease tag.
29
+
30
31
## Reporting a Vulnerability
32
@@ -33,7 +34,7 @@ We get a lot of difficult reports that turn out to be invalid. Clear, obvious re
34
35
First please ensure your report falls within the accepted scope of security bugs (above).
36
36
-**YOU MUST DISCLOSE THE USE OF LLMs ("AI") INVOLVED IN ANY WAY.** Whether you are using AI for discovery, as part of writing the report or its replies, and/or testing or validating proofs and changes, we require you to mention the extent of it. **FAILURE TO INCLUDE A DISCLOSURE MAY LEAD TO IMMEDIATE DISMISSAL OF YOUR REPORT AND POTENTIAL BLOCKLISTING.**
37
+:warning: **YOU MUST DISCLOSE WHETHER YOU USED LLMs ("AI") IN ANY WAY.** Whether you are using AI for discovery, as part of writing the report or its replies, and/or testing or validating proofs and changes, we require you to mention the extent of it. **FAILURE TO INCLUDE A DISCLOSURE EVEN IF YOU DO NOT USE AI MAY LEAD TO IMMEDIATE DISMISSAL OF YOUR REPORT AND POTENTIAL BLOCKLISTING.** We will not waste our time chatting with bots. But if you're a human, pull up a chair and we'll drink some chocolate milk.
38
39
We'll need enough information to verify the bug and make a patch. To speed things up, please include:
40