| Version | Security fixes |
|---|---|
| 4.1.x | Supported |
| 4.0.x | Critical fixes only until the next minor release |
| Earlier | Unsupported |
Do not open a public issue containing an exploit, credential, server address or private configuration. Use GitHub Private Vulnerability Reporting in the repository Security tab. If it is unavailable, contact the maintainer through the private address published on the GitHub profile and request an encrypted channel.
Include the installer version, affected component, reproduction steps, impact and suggested mitigation. Do not test against systems you do not own or administer.
- acknowledgement: 3 business days;
- initial assessment: 7 business days;
- coordinated disclosure after a fix or agreed deadline.
- Restrict network access and preserve logs.
- Rotate PostgreSQL, TURN, registration, MAS and LiveKit secrets.
- Revoke affected Matrix devices/sessions and ntfy credentials.
- Replace the VLESS credential and inspect
/usr/local/etc/xray/config.json. - Review federation/admin logs and restore only from a known-good backup.
- install from tagged GitHub release assets and verify
SHA256SUMS; - external root-level installers are pinned by commit and checksum;
- GitHub Actions are pinned by full commit SHA;
- default container images are pinned by both version tag and OCI digest;
- weekly workflows verify pinned downloads and scan the repository with Trivy, Gitleaks and zizmor.
Image-scan exceptions are stored in .trivyignore.yaml. Every exception must
be restricted to the affected binary path, document why the vulnerable code is
not reachable, and include a short expiration date. Expired entries fail the
scan and must be removed or reviewed against a rebuilt upstream image.
Use SSH keys, restrict administrative IPs, keep the host patched, encrypt offsite backups and monitor disk space. The installer preserves the SSH port detected by sshd -T before enabling UFW.