14 lines
664 B
Markdown
14 lines
664 B
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please report a vulnerability to `security@tinode.co`.
|
|
|
|
## Do NOT to report:
|
|
|
|
* Firebase initialization tokens. The Firebase tokens are really public: they must be distributed with the client applications and consequently are not private by design.
|
|
* Exposed `/pprof` and/or `/expvar`. We know they are exposed. It's intentional and harmless.
|
|
* Exposed Prometheus metrics `/metrics`. Like above, it's intentional and harmless.
|
|
* DMARC policy is not enabled `p=none`. We know and that's the way we like it for now.
|
|
* Weak cipher suites (TLS 1.0) at `*.tinode.co`. Yes, we know. Does not look serious/important.
|