Stashix is early software. Expect bugs, and back up your database before upgrading. Here's how you can help

Reporting security issues

How to report a security vulnerability in Stashix privately, through GitHub or by email, and what to include in the report.

If you find a security problem in Stashix or on stashix.net, report it privately so it can be fixed before it is public. Don’t open a public issue, pull request or discussion about it.

How to report

Use either of these:

GitHub: open a private security advisory on the Stashix repository. Only the maintainers can see it.
Email: write to [email protected].

The same contacts are listed in /.well-known/security.txt.

What to include

The Stashix version, and how it is installed (Docker Compose or from source).
What the problem is and what an attacker could do with it.
Steps to reproduce it, or a proof of concept.
Whether the problem needs an account on the server, and with which role.

What happens next

You’ll get a reply to confirm the report has been received. Once a fix is ready it ships in a release, and the release notes say what was fixed. Tell us if you’d like to be credited.

Stashix is maintained by volunteers and is not yet at version 1.0, so there is no bug bounty.