4.0 KiB
Security Policy
English
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Report them privately through GitHub's private vulnerability reporting:
(Repository → Security tab → Report a vulnerability.) Only the maintainers can see the report, and the advisory becomes the place to discuss, fix, and eventually publish the issue.
A useful report includes:
- The affected component and version (release tag or commit)
- Impact: what an attacker can do and which privileges they need
- Minimal reproduction steps or a proof of concept
- Any non-default configuration required to trigger the issue
- A suggested fix, if you have one
Supported Versions
Sub2API releases frequently, and fixes ship in a new release rather than being backported.
| Version | Supported |
|---|---|
| Latest release | ✅ |
| Older releases | ❌ |
Please confirm that the issue reproduces on the latest release or on main before reporting.
Scope
In scope: the Sub2API backend, frontend, official Docker images, and deployment files in this repository.
Usually out of scope:
- Issues that require already-compromised admin credentials or server access
- Risks arising from explicitly weakening documented security settings (for example, disabling
security.url_allowlist) - Vulnerabilities in upstream AI providers or third-party dependencies with no Sub2API-specific impact (please report those upstream)
- Missing best-practice headers or scanner output without a demonstrated impact
Disclosure Process
- We acknowledge the report and assess its validity and severity.
- We develop a fix privately in the advisory and may ask you to verify it.
- We publish a release containing the fix, then publish the GitHub Security Advisory (with a CVE when applicable), crediting you unless you prefer to stay anonymous.
Please keep details private until the advisory is published. This is a volunteer-maintained project, so response times are best effort.
中文
报告漏洞
请不要通过公开的 Issue、Pull Request 或 Discussion 报告安全漏洞。
请使用 GitHub 私密漏洞报告功能提交：
（仓库 → Security 标签页 → Report a vulnerability。）报告仅维护者可见，后续的讨论、修复与公告发布都在该安全公告中进行。
报告中建议包含：
- 受影响的组件与版本（Release tag 或 commit）
- 影响：攻击者能做什么、需要什么权限
- 最小复现步骤或 PoC
- 触发问题所需的非默认配置
- 修复建议（如有）
支持的版本
Sub2API 发版频繁，安全修复随新版本发布，不向旧版本回移。
| 版本 | 是否支持 |
|---|---|
| 最新 Release | ✅ |
| 更早的版本 | ❌ |
报告前请先确认问题在最新 Release 或 main 上仍可复现。
范围
范围内：本仓库中的 Sub2API 后端、前端、官方 Docker 镜像与部署文件。
通常不在范围内：
- 需要事先已掌握管理员凭据或服务器权限才能利用的问题
- 因主动关闭文档中的安全配置（如关闭
security.url_allowlist）而产生的风险 - 上游 AI 服务商或第三方依赖自身的漏洞，且对 Sub2API 无特定影响（请向上游报告）
- 仅缺少最佳实践响应头或扫描器输出，但未证明实际影响
披露流程
- 我们确认收到报告，并评估其有效性与严重程度。
- 我们在安全公告中私下开发修复，可能请你协助验证。
- 我们先发布包含修复的版本，再公开 GitHub 安全公告（适用时申请 CVE），并致谢报告者（如你希望匿名则不署名）。
在公告发布前请勿公开漏洞细节。本项目由志愿者维护，响应时间尽力而为。