From 9c20d24869dc9f11039a34c6aeda3395c4589d92 Mon Sep 17 00:00:00 2001 From: bo0tzz Date: Sat, 25 Jul 2026 19:26:07 +0200 Subject: [PATCH 1/2] chore: prefer security reports via GHSA Originally in https://github.com/immich-app/.github/pull/36 because I failed to realise this overrides that --- .../modules/shared/github/org/org-meta-files/SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md b/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md index 1877440a8..f8dd87cc3 100644 --- a/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md +++ b/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md @@ -2,4 +2,4 @@ ## Reporting a Vulnerability -Please report security issues to `security@immich.app` +Please report security issues via https://github.com/immich-app/immich/security/advisories/new or to `security@immich.app` From 332baee7ab568e617ae83cd08ba0e4e5f3aa9fb3 Mon Sep 17 00:00:00 2001 From: bo0tzz Date: Sat, 25 Jul 2026 20:14:36 +0200 Subject: [PATCH 2/2] feat: add scope to security policy --- .../shared/github/org/org-meta-files/SECURITY.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md b/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md index f8dd87cc3..40cfe550b 100644 --- a/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md +++ b/tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md @@ -3,3 +3,19 @@ ## Reporting a Vulnerability Please report security issues via https://github.com/immich-app/immich/security/advisories/new or to `security@immich.app` + +## Scope + +The following are out of scope: + +* Surrounding infrastructure (redis, postgres, admin additions like reverse proxy configuration): These are the admin's responsibility. +* Attacks that require an attacker to already be an authenticated administrator: The Immich admin is already the owner of the machine. +* Network access to immich-machine-learning: It should not be made accessible outside of the container network. An attack smuggled via immich-server is still in scope. +* Automated scanner output with no demonstrable impact. +* Login hardening features, specifically rate limiting and MFA: These should be delegated to an OAuth server. +* Resource exhaustion by an authenticated user through mechanisms that are normally expected to consume significant resources. +* Installations that don't use our official container images + +## LLM-assisted reports + +If you use an LLM to help find or describe an issue, you must confirm the behaviour yourself and include a tested step-by-step reproduction against a fresh Immich instance.