27 lines
1.1 KiB
Markdown
27 lines
1.1 KiB
Markdown
|
# Security Policy
|
||
|
|
|
||
|
|
## Supported Versions
|
||
|
|
|
||
|
|
To receive fixes for security vulnerabilities it is required to always upgrade to the latest version of Keycloak.
|
||
|
|
See https://www.keycloak.org/downloads for the latest release.
|
||
|
|
|
||
|
|
Fixes will only be released for previous releases under special circumstances.
|
||
|
|
|
||
|
|
## Reporting a Vulnerability
|
||
|
|
|
||
|
|
To report a security vulnerability:
|
||
|
|
|
||
|
|
You can report a security vulnerability either through email, or in our issue tracker. If you are uncertain what you have
|
||
|
|
discovered is a vulnerability or you believe it is a critical issue please report using email (or both).
|
||
|
|
|
||
|
|
To report through email send an email to keycloak-security@googlegroups.com.
|
||
|
|
|
||
|
|
To report through issue tracker:
|
||
|
|
|
||
|
|
* Go to https://issues.jboss.org/browse/KEYCLOAK
|
||
|
|
* Create a new issue in the Keycloak project
|
||
|
|
* Make sure the "This issue is security relevant" checkbox is checked
|
||
|
|
|
||
|
|
If you have a patch for the issue please use `git format-patch` and attach to the email or issue. Please do not open a
|
||
|
|
pull request on GitHub as that may disclose sensitive details around the vulnerability.
|