Vulnerability disclosure
This page is for administrators, security officers and project managers. Two disclosure channels matter for a public
site: the project's, for vulnerabilities in Exponential itself, and your own, for vulnerabilities in your site. The
project rates its coordinated disclosure Partly complies: SECURITY.md with a private channel exists, a
security.txt is not shipped (Security standards: Vulnerability disclosure).
Note This page describes features and common practice; it is not legal advice. Check the law that applies to your organization with your legal counsel.
Contents
The project's policy
From SECURITY.md:
- Exponential 6.0 is the maintained line. Fixes are made on
mainand published with the next 6.0.x release. - Released tags of 6.0.x are fixed by upgrading to the newest 6.0.x; 5.x and older are not supported.
- A published tag is never changed: a fix arrives as the next release, not as a corrected copy.
- Reports go privately to [email protected], not to the public issue tracker; a first answer is promised within one business day; the reporter is told whether the report is accepted and kept informed.
Reporting a vulnerability in Exponential
Write to [email protected] or open a private advisory on GitHub (https://github.com/se7enxweb/exponential/security/advisories/new). Include:
- the version (
composer show se7enxweb/exponential, or the tag or commit) and the PHP version; - the engine serving the site (Velocity, FrankenPHP, Apache or nginx with PHP-FPM) and the database;
- what an attacker can do and the steps to reproduce.
Leave out passwords, secrets and personal data (Security hardening: Reporting a vulnerability). For an extension, report to its own repository's maintainers; where unsure, the same address.
Your own disclosure policy
Many public bodies publish a vulnerability disclosure policy for their own sites. Its usual parts:
| Part | Content |
|---|---|
| Scope | which domains and services are covered; what is out of scope (third-party services) |
| How to report | a contact (mailbox or form), the language(s), an encryption key if you offer one |
| What you promise | acknowledgment time, updates, no legal action for good-faith research within the rules (as your counsel approves) |
| Rules for researchers | no data access beyond the minimum, no service disruption, no social engineering, delete data after reporting |
| Recognition | whether you thank researchers publicly |
Then:
- Publish the policy as a page of your site with a stable URL alias.
- Publish a
security.txt(RFC 9116) pointing to it (see "Adding security.txt"). - Route the mailbox to people who can act, with a deputy.
- Forward reports about Exponential itself to the project, as above.
Related pages
- SECURITY.md
- Security updates and disclosure for hosts
- When something goes wrong
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.