mirror of
https://github.com/TautvydasDerzinskas/Thingport.git
synced 2026-10-21 22:22:24 -05:00
65 lines
2.2 KiB
YAML
65 lines
2.2 KiB
YAML
name: Security improvement
|
|
description: Suggest hardening, or report a security issue that is already public or harmless to disclose
|
|
labels: [security]
|
|
body:
|
|
- type: markdown
|
|
attributes:
|
|
value: |
|
|
**Found a vulnerability someone could exploit?** Don't open a public issue. [Report it privately](https://github.com/TautvydasDerzinskas/Thingport/security/advisories/new) instead.
|
|
- type: textarea
|
|
id: what
|
|
attributes:
|
|
label: What's the concern?
|
|
description: The weakness or missing protection, and what could go wrong because of it.
|
|
validations:
|
|
required: true
|
|
- type: dropdown
|
|
id: component
|
|
attributes:
|
|
label: Where?
|
|
options:
|
|
- Thingport (web app or API)
|
|
- Thingport Grab (browser extension)
|
|
- Thingport Bridge (desktop helper)
|
|
- Docker images or deployment
|
|
- Website or docs
|
|
validations:
|
|
required: true
|
|
- type: textarea
|
|
id: idea
|
|
attributes:
|
|
label: What would you suggest?
|
|
- type: input
|
|
id: backend_version
|
|
attributes:
|
|
label: Backend version
|
|
description: >-
|
|
Shown in Administration > Update Checker as "Running backend 1.2.0 · frontend 1.1.0". Not an admin? Ask
|
|
yours. No version shown means a build from before versioning: give the image tag instead.
|
|
placeholder: "e.g. 1.2.0"
|
|
- type: input
|
|
id: frontend_version
|
|
attributes:
|
|
label: Frontend version
|
|
description: On the same line in Administration > Update Checker; the backend and frontend are versioned apart.
|
|
placeholder: "e.g. 1.1.0"
|
|
- type: input
|
|
id: grab_version
|
|
attributes:
|
|
label: Thingport Grab version
|
|
description: If Grab is involved. It's at the bottom of Grab's popup.
|
|
placeholder: "e.g. v1.5.0"
|
|
- type: input
|
|
id: image_tags
|
|
attributes:
|
|
label: Docker image tags
|
|
description: The tags you run, from your docker-compose file or `docker compose images`.
|
|
placeholder: "e.g. :latest, :1.2.0 or :sha-abc1234"
|
|
- type: checkboxes
|
|
id: public
|
|
attributes:
|
|
label: Disclosure
|
|
options:
|
|
- label: This is safe to discuss publicly; it isn't an exploitable vulnerability in a released version.
|
|
required: true
|