hometown/SECURITY.md

# Security Policy

If you believe you've identified a security vulnerability in Mastodon (a bug that allows something to happen that shouldn't be possible), you can reach us at <security@joinmastodon.org>.

You should *not* report such issues on GitHub or in other public spaces to give us time to publish a fix for the issue without exposing Mastodon's users to increased risk.

## Scope

A "vulnerability in Mastodon" is a vulnerability in the code distributed through our main source code repository on GitHub. Vulnerabilities that are specific to a given installation (e.g. misconfiguration) should be reported to the owner of that installation and not us.

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 4.1.x   | Yes                |
| 4.0.x   | No                 |
| < 4.0   | No                 |
Add Security Policy (#13946) 6 years ago			`# Security Policy`

Change e-mail in SECURITY.md (#20384) 3 years ago			`If you believe you've identified a security vulnerability in Mastodon (a bug that allows something to happen that shouldn't be possible), you can reach us at <security@joinmastodon.org>.`
Remove references to discourse.joinmastodon.org (#17797) Remove broken CODEOWNERS file Add sponsor.joinmastodon.org to FUNDING.yml 4 years ago
			`You should not report such issues on GitHub or in other public spaces to give us time to publish a fix for the issue without exposing Mastodon's users to increased risk.`

			`## Scope`

			`A "vulnerability in Mastodon" is a vulnerability in the code distributed through our main source code repository on GitHub. Vulnerabilities that are specific to a given installation (e.g. misconfiguration) should be reported to the owner of that installation and not us.`

Add Security Policy (#13946) 6 years ago			`## Supported Versions`

Merge changes of 4.0.7..4.0.10 (#1324) This includes all changes made in https://github.com/mastodon/mastodon/releases/tag/v4.0.7 and https://github.com/mastodon/mastodon/releases/tag/v4.0.8 and therefore requires: :warning: Restart of all Mastodon processes, especially the Streaming API There was a conflict during the merge inside the `streaming/index.js`, which was related to the following snippet: ```js // Only send local-only statuses to logged-in users if (payload.local_only && !req.accountId) { log.silly(req.requestId, `Message ${payload.id} filtered because it was local-only`); return; } ``` I've placed it at the same spot where it was previously, so everything should work as before. ~~However, I still need to test those changes, which is what I'll be doing after submitting this PR as draft.~~ Checked the changes against our instance, everything is working as expected as logged-in user. Haven't checked the public timelines where the above snippet would be relevant, as we are using `AUTHORIZED_FETCH` and I would like to keep it enabled. ^^ If the base branch is not correct, feel free to change it. Everything is already deployed on queer.group and working fine there. --------- Co-authored-by: Michael Stanclift <mx@vmstan.com> Co-authored-by: Claire <claire.github-309c@sitedethib.com> Co-authored-by: Eugen Rochko <eugen@zeonfederated.com> Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com> Co-authored-by: Renaud Chaput <renchap@gmail.com> Co-authored-by: Daniel M Brasil <danielmbrasil@protonmail.com> Co-authored-by: yufushiro <62991447+yufushiro@users.noreply.github.com> Co-authored-by: Nicolai Søborg <NicolaiSoeborg@users.noreply.github.com> 3 years ago			`\| Version \| Supported \|`
			`\| ------- \| ------------------ \|`
			`\| 4.1.x \| Yes \|`
Merge security fixes of mastodon v4.0.13 (#1340) There were some smaller merge conflicts (e.g. in `lib/version.rb`), but all of them were of smaller nature. Due to the fact that other v4.0.* versions are also included, it's a bit bigger than the other PR for 3.5. I won't repeat the changelog here, the upgrade is the usual git pull and restart all mastodon processes. --------- Co-authored-by: Michael Stanclift <mx@vmstan.com> Co-authored-by: Claire <claire.github-309c@sitedethib.com> Co-authored-by: Eugen Rochko <eugen@zeonfederated.com> Co-authored-by: Emelia Smith <ThisIsMissEm@users.noreply.github.com> Co-authored-by: Renaud Chaput <renchap@gmail.com> Co-authored-by: Daniel M Brasil <danielmbrasil@protonmail.com> Co-authored-by: yufushiro <62991447+yufushiro@users.noreply.github.com> Co-authored-by: Nicolai Søborg <NicolaiSoeborg@users.noreply.github.com> Co-authored-by: Essem <smswessem@gmail.com> Co-authored-by: Jakob Gillich <jakob@gillich.me> Co-authored-by: David Aaron <1858430+suddjian@users.noreply.github.com> Co-authored-by: Matt Jankowski <matt@jankowski.online> 2 years ago			`\| 4.0.x \| No \|`
			`\| < 4.0 \| No \|`