Skip to content

feat: add scope to security policy #1855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bo0tzz wants to merge 2 commits into
base: main
Choose a base branch
from
+17 −1
Open

feat: add scope to security policy #1855

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c20d24
chore: prefer security reports via GHSA
bo0tzz Jul 25, 2026
332baee
feat: add scope to security policy
bo0tzz Jul 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion tf/deployment/modules/shared/github/org/org-meta-files/SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,20 @@

## Reporting a Vulnerability

Please report security issues to `security@immich.app`
Please report security issues via https://github.com/immich-app/immich/security/advisories/new or to `security@immich.app`

## Scope

The following are out of scope:

* Surrounding infrastructure (redis, postgres, admin additions like reverse proxy configuration): These are the admin's responsibility.
* Attacks that require an attacker to already be an authenticated administrator: The Immich admin is already the owner of the machine.
* Network access to immich-machine-learning: It should not be made accessible outside of the container network. An attack smuggled via immich-server is still in scope.
* Automated scanner output with no demonstrable impact.
* Login hardening features, specifically rate limiting and MFA: These should be delegated to an OAuth server.
* Resource exhaustion by an authenticated user through mechanisms that are normally expected to consume significant resources.
* Installations that don't use our official container images

## LLM-assisted reports

If you use an LLM to help find or describe an issue, you must confirm the behaviour yourself and include a tested step-by-step reproduction against a fresh Immich instance.
Loading