kenmirrors/firefly-iii
1
0
Fork 0
mirror of https://github.com/firefly-iii/firefly-iii.git synced 2026-07-23 16:04:46 -07:00
Code Issues Projects Releases Wiki Activity

Update security.md to specify SSRF and DNS issues

Browse Source 
Clarified security advisory guidelines regarding SSRF and DNS/hostname issues.

Signed-off-by: James Cole <james@firefly-iii.org>
This commit is contained in:
James Cole
2026-06-30 18:42:08 +02:00
committed by GitHub
parent 6535a3741f
commit 1136eb8542
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/security.md
+1 -1
View File
@@ -8,7 +8,7 @@ disclosure and response policy to ensure that critical issues are responsibly ha
> [!WARNING]
> Due to a large number of irrelevant, noisy and uninformed AI-generated security advisories coming my way, reporting any the following security issues may result in a permanent ban from the Firefly III organization on GitHub.
1. Any SSRF in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design that users may set-up any URL they want, be it internal, private or non-existing.
1. Any SSRF or DNS/hostname issues in any user provided URL field (webhooks, ntfy, SimpleFIN, Slack). It's by design that users may set-up any URL they want, be it internal, private or non-existing.
2. Any XSS issue without a viable attack tree. If you can find a spot where Firefly III or the associated tools render unescaped data, it's not a security issue unless you can show me an actual attack that gets that data into the system.
3. Any issue that is not true. AI models have already *hallucinated* security issues in Firefly III. They've referred to **non-existing** functions, templates and files. Including line numbers and code excerpts. Validate your findings before you report them to me.