| <!-- |
| Licensed to the Apache Software Foundation (ASF) under one or more |
| contributor license agreements. See the NOTICE file distributed with |
| this work for additional information regarding copyright ownership. |
| The ASF licenses this file to You under the Apache License, Version 2.0 |
| (the "License"); you may not use this file except in compliance with |
| the License. You may obtain a copy of the License at |
| |
| https://www.apache.org/licenses/LICENSE-2.0 |
| |
| Unless required by applicable law or agreed to in writing, software |
| distributed under the License is distributed on an "AS IS" BASIS, |
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| See the License for the specific language governing permissions and |
| limitations under the License. |
| --> |
| |
| # Security policy |
| |
| ## Reporting a vulnerability |
| |
| Report suspected security vulnerabilities in Apache Roller privately to the |
| Apache Security Team at [security@apache.org](mailto:security@apache.org). |
| Please do **not** report them in the public issue tracker, in GitHub issues or |
| pull requests, or on the public mailing lists. |
| |
| A useful report says which Roller version you tested, how the site is |
| configured in any way that matters to the issue, and what steps reproduce the |
| behaviour. If you are not sure whether what you found is a vulnerability, |
| report it privately anyway and we will work it out with you. |
| |
| The Apache Security Team forwards the report to the Roller PMC. See the |
| [ASF security page](https://www.apache.org/security/) for the foundation-wide |
| process. |
| |
| ## Security model |
| |
| The [Roller security model](docs/security-model.md) explains who Roller trusts, |
| what each kind of user may do, and what counts as a vulnerability. Please read |
| it before you report. |
| |
| ## Supported versions |
| |
| Security fixes are made on the current release line and shipped in a new |
| release. Older releases are not patched. If you run an older version, upgrade |
| to the [current release](https://roller.apache.org/downloads/downloads.html). |
| |
| ## Advisories |
| |
| Advisories are listed at <https://roller.apache.org/security.html>. |
