Reporting vulnerabilities
هذا المحتوى غير متوفر بلغتك بعد.
Please do not open a public issue for a security problem.
Use GitHub’s private vulnerability reporting on the repository’s Security tab. Include what you found, how to reproduce it, the version affected and your assessment of the impact.
We aim to acknowledge reports promptly, fix confirmed issues, and credit reporters who want credit once a fix is released.
In scope: the server, the web, desktop and Android clients, and the official Docker images.
Out of scope: social engineering, attacks that need a malicious server operator (the model is server-trusted), and findings that only affect unsupported or modified builds.