Security fixes are applied to the latest stable release of each affected Haraka package. Older major versions receive fixes only for critical (CVSS ≥ 9.0) vulnerabilities.

Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities using one of these private channels:

1. GitHub private security advisory (preferred):
   https://github.com/haraka/Haraka/security/advisories/new

2. Email: [email protected] Encrypt sensitive reports with the maintainers' PGP key (available on request).

Include as much of the following as possible:

• Affected package(s) and version(s)
• A description of the vulnerability and its impact
• Steps to reproduce or a proof-of-concept
• Any suggested mitigations

We follow coordinated disclosure. If a reporter has a shorter disclosure deadline, please note it in your report.

We use CVSS v3.1 to score vulnerabilities:

• A report is received via private advisory or email.
• A maintainer acknowledges receipt and creates a private GitHub security advisory if one does not already exist.
• The reporter is added as a collaborator on the advisory.

• A maintainer reviews the report.
• Assign a CVSS score and severity label.
• Determine affected packages and version ranges.
• Identify whether a workaround exists.

• A private fork or branch is created off the affected package's main branch.
• A fix is developed and reviewed privately by at least one maintainer who did not write the fix.
• Tests are added covering the vulnerability.
• The fix is validated against all supported Node.js versions using the existing CI matrix.

• A patched version is published to npm.
• The GitHub security advisory is published, referencing the CVE (requested from GitHub if not already assigned).
• Release notes include a security section describing the vulnerability at a high level without a full exploit guide.
• Affected users are notified via:
  • GitHub security advisory (automatic for users watching the repo)
  • A post in the Haraka discussion forums / mailing list if severity is High or Critical

The following are considered in-scope for security reports:

• Remote code execution, privilege escalation, or authentication bypass in core Haraka or any haraka-plugin-* package
• Denial-of-service vulnerabilities exploitable by unauthenticated remote attackers
• Header injection, SMTP smuggling, or email spoofing facilitated by Haraka
• Sensitive data exposure (credentials, email content) due to insecure defaults

The following are out of scope:

• Vulnerabilities in dependencies (report to the upstream project; we will update the dependency)
• Issues that require physical access to the server
• Social engineering or phishing attacks
• Findings from automated scanners without a demonstrated impact

We are grateful to security researchers who responsibly disclose vulnerabilities. With the reporter's permission, we acknowledge contributors in the security advisory and in the package CHANGELOG.

For questions about this policy, open a GitHub Discussion or email [email protected].