At Dokploy, security is a top priority. We appreciate the help of security researchers and the community in identifying and reporting vulnerabilities.
If you have discovered a security vulnerability in Dokploy, please report it responsibly using one of the following channels:
- GitHub Security Advisories (preferred): Open a private report at github.com/Dokploy/dokploy/security/advisories/new. This lets us discuss, fix, and publish the advisory with you directly, and credit you once it is resolved.
- Email (alternative): If you can't use GitHub, send your report to contact@dokploy.com.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Include as much information as possible to help us understand and reproduce the vulnerability:
- A clear description of the vulnerability.
- Steps to reproduce the vulnerability.
- Any sample code, screenshots, or videos that might be helpful.
- The affected version(s) of Dokploy.
- The potential impact of the vulnerability.
- Do not make the vulnerability public: Please refrain from publicly disclosing the vulnerability until we have had the opportunity to investigate and address it. This is crucial for protecting our users.
- Allow us time: We will acknowledge receipt of your report as soon as possible and keep you informed of our progress. The time to resolve the vulnerability may vary depending on its complexity and severity.
- Publication: Once a fix is released, we will publish a GitHub Security Advisory and credit the reporter, unless you prefer to remain anonymous.
- Do not access user data or systems beyond what is necessary to demonstrate the vulnerability.
- Do not perform denial-of-service (DoS) attacks, spamming, or social engineering.
- Do not modify or destroy data that does not belong to you.
We are committed to working with you quickly and responsibly to address any legitimate security vulnerability.
Thank you for helping us keep Dokploy secure for everyone.