Security and software vulnerabilities

The Semantic MediaWiki project is cautious about security aspects and strives to eliminate any possible vulnerabilities in its maintained software.

Reporting a vulnerability

Please report security vulnerabilities privately through GitHub's private vulnerability reporting, not through public issues, pull requests, or wiki pages. See the security policy for details.

Special care is needed to minimize the exploitation risk while a fix is being prepared. The project is public and can be monitored by potential attackers, so please avoid describing a vulnerability in public channels, including commit messages such as "Fixed critical security vulnerability", until a fixed version has been released. For more information on handling security problems in open-source software, see Producing Open Source Software, Chapter 6. Communications: Announcing Security Vulnerabilities.

See also

Detailed information on how to report bugs.