301194963b
一些检查失败了
automerge / automerge (push) Has been cancelled
react-native-android-build-apk / AssembleRelease (push) Has been cancelled
Build macOS M1 / Main (push) Has been cancelled
Joplin Continuous Integration / Main (macos-15-intel) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / Main (ubuntu-22.04-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-11-vs2026-arm) (push) Has been cancelled
Joplin Continuous Integration / Main (windows-2025) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04) (push) Has been cancelled
Joplin Continuous Integration / ServerDockerImage (ubuntu-22.04-arm) (push) Has been cancelled
Joplin UI tests / Main (ubuntu-22.04) (push) Has been cancelled
Joplin UI tests / Main (windows-2025) (push) Has been cancelled
Joplin UI tests / Mobile (push) Has been cancelled
Close stale issues / ProcessStaleIssues (push) Has been cancelled
57 行
3.0 KiB
Markdown
57 行
3.0 KiB
Markdown
# Security Policy
|
|
|
|
> [!IMPORTANT]
|
|
> Before submitting a report, please read the [Rules for reporting](#rules-for-reporting).
|
|
|
|
## Supported Versions
|
|
|
|
Only the latest version is supported with security updates.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please report vulnerabilities [through private vulnerability reporting](https://github.com/laurent22/joplin/security/advisories/new) **with a proof of concept** that shows the security vulnerability. Please do not contact us without this proof of concept, as we cannot fix anything without this.
|
|
|
|
For general opinions on what makes an app more or less secure, please use the forum.
|
|
|
|
## Rules for reporting
|
|
|
|
Joplin is maintained by a small team, and we receive a high volume of reports that have not been verified by the person submitting them. Reviewing and reproducing an unverified finding takes us as long as a real one, so we need a few rules to keep the process workable for everyone.
|
|
|
|
- **Two active reports per person.** If you have more than two open at once, we may close them all, and we may block the account.
|
|
|
|
- **Verify your report before submitting it.** Confirm that the issue is still present in the latest version, and that you have actually carried out the steps your conclusion relies on. Repeatedly submitting findings that do not hold up may result in a permanent block.
|
|
|
|
## Areas outside Joplin's Threat Model
|
|
|
|
Note: we're mostly linking to Chrome's documentation since our reasoning for these exclusions is the same.
|
|
|
|
### Denial of Service (DoS)
|
|
|
|
[Reference](https://chromium.googlesource.com/chromium/src.git/+/master/docs/security/faq.md#are-denial-of-service-issues-considered-security-bugs)
|
|
|
|
### Physically-local attacks
|
|
|
|
[Reference](https://chromium.googlesource.com/chromium/src.git/+/master/docs/security/faq.md#why-arent-physically_local-attacks-in-chromes-threat-model)
|
|
|
|
### Compromised/infected machines
|
|
|
|
[Reference](https://chromium.googlesource.com/chromium/src.git/+/master/docs/security/faq.md#why-arent-compromised_infected-machines-in-chromes-threat-model)
|
|
|
|
### Is opening a file on the local machine a security vulnerability?
|
|
|
|
No - users are allowed to link to files on their local computer. This was a feature that was implemented by popular request. There are measures in place to mitigate security risks such as a dialog to confirm whether a file with an unknown file extension should be opened.
|
|
|
|
### Is DLL sideloading a security vulnerability?
|
|
|
|
No. This is an Electron issue and not one they will fix: https://github.com/electron/electron/issues/28384
|
|
|
|
See also [Physically-local attacks](https://chromium.googlesource.com/chromium/src.git/+/master/docs/security/faq.md#why-arent-physically_local-attacks-in-chromes-threat-model)
|
|
|
|
### Is local data not being encrypted a security vulnerability?
|
|
|
|
No, but you should use disk encryption. See also [Physically-local attacks](https://chromium.googlesource.com/chromium/src.git/+/master/docs/security/faq.md#why-arent-physically_local-attacks-in-chromes-threat-model)
|
|
|
|
## Bounty
|
|
|
|
We **do not** offer a bounty for discovering vulnerabilities, please do not ask.
|