> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/security/cipp-security-and-compliance/security-policy.md). # Security Policy ## Supported Versions The current release is the only supported version and shouldn't have any security bugs. However if you find a security issue in an older release feel free to also report this in case of regression. It's important that to know about past mistakes to help avoid repetition in the future. ## Reporting a Vulnerability Reporting a vulnerability is best done by emailing . You can also message an administrator directly on the CyberDrain Discord. The administrators involve all relevant contributors in discussing the issue in private and addressing it if appropriate. Your cooperation in reporting security issues in this way assists in making any fix available as soon as possible without endangering other users of the product. The project publicly posts security reports after resolution, including all communications. If you would rather have only the bug report public, please include this fact when making the report. ## Notifications and Security Advisories Security notification reporting is via the GitHub notification and advisory system. Sponsors with hosted instances receive a notification directly. ## Bounties and Rewards This project is an open-source sponsor-ware effort, which makes it hard to create a monetary reward without breaking the bank. For *critical* security bugs, involving things like remote code execution or API data leaks, the project aims to offer a 50-dollar reward. For other bugs, the project may reward with some swag such as an official CyberDrain t-shirt or hoodie. ## Investigating Vulnerabilities Please see the Vulnerability Disclosure Policy for more information on how to investigate vulnerabilities and associated commitments and expectations. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.cipp.app/security/cipp-security-and-compliance/security-policy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.