Story: security
This page is for journalists who cover the security of open source software. No honest source says any software "is secure"; what the sources of Exponential do describe is a process and a set of protections. This page gives both, with dates and sources, and tells you how to handle a vulnerability someone shows you.
Contents
- The story in one paragraph
- What is new, and when
- Facts you can print
- What not to claim
- If someone shows you a vulnerability
- Angles and headline ideas
- Who to ask
- Related pages
The story in one paragraph
Exponential's security policy fits on one page. "Please report security issues privately by e-mail to
[email protected], not in the public issue tracker or the discussions. You can expect a first answer within one
business day." Fixes are made on main and "published with the next 6.0.x release", and "A published tag is never
changed" (SECURITY.md). Around that process the 6.0.15 line adds protections an
administrator can see: a Content Security Policy, a tamper-evident audit trail, two-step sign-in, refusal of
well-known passwords and an administration without inline scripts
(6.0.15 changelog).
What is new, and when
All in the 6.0.15 line, the current release line of Exponential 6.0; the dates are dates of the changes, not a release date.
| What | When | Source |
|---|---|---|
| Security defaults: headers on every page, the session cookie, uniform login answers | 16 to 30 September 2026 | 6.0.15 changelog |
| The audit trail, on by default | 2 October 2026 | The audit trail |
| Two-step sign-in in the changelog | 6 October 2026 | 6.0.15 changelog |
| Administration hardening | 14 October 2026 | 6.0.15 changelog |
| SVG images sanitized on upload | 15 October 2026 | 6.0.15 changelog |
| A Content Security Policy, report-only on the administration | 16 October 2026 | 6.0.15 changelog |
| Well-known passwords refused; forgot-password links expire | 18 October 2026 | 6.0.15 changelog |
Facts you can print
| Fact | Source |
|---|---|
| Reports go privately to [email protected]; first answer within one business day. | SECURITY.md |
| 6.0.x is the maintained line; 5.x, 4.x, 3.x and older are not supported. | same |
| A fix never changes a published version; it arrives as the next release. | same |
| A new installation generates a random administrator password when none or a well-known one is given. | The default administrator password |
A forgot-password link works for one hour (ForgotPasswordKeyLifetime). | 6.0.15 changelog, Upgrading |
| Probes and attacks are classified into a security log, with masked addresses. | Talking points: security |
| The se7enxweb profile reports 14 security pull requests to Zeta Components in April 2026. | The PHP stack it stands on |
| Administrators get a threat-by-threat hardening guide with a checklist. | Security hardening |
What not to claim
- "Exponential is secure", "unhackable", "bank-grade". Describe the process and the protections.
- "It has never had a vulnerability." No source says so.
- "Compliant with" any law or standard. Compliance depends on how a site is built and run.
- "Support answers within N hours." The only documented time is the first answer to a security report.
- Details of any vulnerability that has not been published with its fix.
If someone shows you a vulnerability
Do not publish details of an unfixed vulnerability. Ask the person to report it privately to [email protected], as SECURITY.md asks, and report only after the fix is released. Do not test it against a site that is not yours. The routine for advocates applies to reporters too: Security reports stay private.
Angles and headline ideas
"One business day: how an old open source CMS answers security reports"
"Fixed in the next release, never in the old one: Exponential's rule for security fixes"
"Process, not promises: inside Exponential's security work"Who to ask
| Question | Ask | Where |
|---|---|---|
| The security process, on the record | 7x | [email protected], or https://exponential.earth/about/contact-us |
| A vulnerability | privately, never in public | [email protected] |
Related pages
- Talking points: security
- Story: the Content Security Policy
- Story: the audit trail
- Story: two-step sign-in
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.