Security policy

Reporting a vulnerability

Please do not report security issues in public issues, pull requests or discussions. Public disclosure before a fix is available puts every running install at risk.

Report privately through GitHub's private vulnerability reporting: open the Security tab of the Atelier CMS repository, choose Report a vulnerability and fill in the form. For the atelier command and the desktop app, use the Manager repository in the same way.

A good report names the affected component and version, describes the issue and its impact, gives steps to reproduce, and lists any workaround you know of.

If you can't use GitHub, email security@aincient-labs.com.

What to expect

• An acknowledgement within 3 business days.
• An initial assessment (severity, whether we can reproduce it, a rough timeline) within 7 business days.
• Regular updates while we work on a fix.
• Credit in the advisory and release notes when the fix ships, unless you prefer to stay anonymous.

We follow coordinated disclosure: we agree a disclosure date with you, publish an advisory when the fix is available, and ask that details stay private until then.

Scope

Any part of the shipped product is in scope: the container image, the console, the custom modules and themes, the appliance update flow, and the atelier command and desktop app. Atelier is built on Drupal and bundles other software. If the problem is in an upstream project, we help coordinate with its maintainers, and reporting it to them directly is often faster.

Supported versions

Atelier is released as a container image, and an install updates to the current release with atelier app update. Security fixes ship as patch releases as soon as they are ready, without waiting for feature work. They are provided for the latest release; upgrading to it is how you receive them.

Security announcements

Each release that fixes a security issue gets an advisory on the security page. The Atom feed carries security releases only.