mirrors/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-11-15 18:55:07 +03:00
Code Issues Packages Projects Releases Wiki Activity
20,711 Commits 2 Branches 181 Tags
dev
Commit Graph

33 Commits

  • docs: point the security policy to the documentation (#32032) 
    The full security policy now lives on the documentation site, so it only has to be kept up to date in one place. This file keeps a link to it and the one reporting channel we accept, since GitHub shows this file to reporters on the Security tab.
    Classic298 · 2026-10-07 17:39:51 +04:00
    e4cdc1377d
  • docs: friendlier security policy wording (#32031) 
    Good-faith reports that turn out not to be vulnerabilities are now explicitly welcomed, and the line about barring reporters is softened so it only targets repeated or deliberate rule breaking. The section on foreign CNAs moves near the end, dashes are gone, a few redundant sentences are cut and the last-updated date is today.
    Classic298 · 2026-10-07 08:18:51 -05:00
    a575b77429
  • refac
    Timothy Jaeryang Baek · 2026-10-01 03:31:20 +04:00
    f50f9e6252
  • docs: align security policy framing with project ownership (#27431) 
    The security policy described Open WebUI as "a small volunteer team" and "a volunteer- and community-driven project", and explained response times as a shortage of capacity. Read by enterprise evaluators, security researchers and third parties trying to impose disclosure timelines, that wording makes the project look informal, under-resourced and externally steerable, which is the opposite of the position the policy is meant to hold.

Open WebUI is led and maintained by a small core team with clear ownership of the security process. This updates the wording to say that, and reframes response times as prioritisation across the project rather than a capacity shortfall. No rule, scope, commitment or timeline changes: the reporting channel, the disclosure schedule, the credit rules and the expected timeframe all stay exactly as they were.

Also removes the implicit first-come-first-served promise in the follow-up paragraph, which contradicted the severity-based prioritisation stated two paragraphs later, and bumps the last-updated date.
    Classic298 · 2026-07-24 12:37:23 -04:00
    e32c6743ba
  • refac
    Timothy Jaeryang Baek · 2026-07-09 17:38:19 -05:00
    d3ea8eb7e7
  • refac
    Timothy Jaeryang Baek · 2026-07-09 17:28:45 -05:00
    a489e4f219
  • refac
    Timothy Jaeryang Baek · 2026-06-29 10:04:29 -05:00
    f9c3ccd869
  • chore: Update SECURITY.md (#25773) 
    * Update SECURITY.md

* Update SECURITY.md

* Update SECURITY.md

* Update SECURITY.md

* Update SECURITY.md

* Update SECURITY.md

* Update SECURITY.md

* Update SECURITY.md

* Extend the already-fixed/monitoring rule to public PRs and credit

Broaden the rule from "already fixed" to also cover issues already being fixed in
the open (e.g. an open pull request), extend the commit-monitoring pattern to PRs,
and fold in the credit consequence on provable grounds rather than an unprovable
bad-faith claim: a report of an already-public, already-fixed-or-being-fixed issue
filed strictly last is a duplicate we cannot distinguish from scraping, so it earns
no advisory. Credit belongs to whoever found or fixed it, who forfeits it by
disclosing publicly instead of reporting confidentially first — so a public fix
earns no advisory and no credit for anyone.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Remove Rule 14 (One Vulnerability Per Report)

The one-CVE-per-vulnerability constraint it restated is a CVE Program counting
rule, already binding through the "Alignment with the CVE Program" section.
Dropping the standalone rule removes the duplication; bundled reports are still
split on that basis when they arise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* security policy: surface "What a Valid Report Gets You" near the top, refresh date

Move the "What a Valid Report Gets You" section up to directly under the good-faith
reporting section (it leads with what reporters receive, rather than burying it
below the rules), and update the last-updated date.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Update SECURITY.md

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
    Classic298 · 2026-06-29 02:11:17 -05:00
    c31694af09
  • Update SECURITY.md (#24726)
    Classic298 · 2026-05-15 09:30:48 +09:00
    6360af36d8
  • refac
    Timothy Jaeryang Baek · 2026-05-09 05:15:12 +09:00
    3ab7b777b1
  • chore: Update SECURITY.md (#24363) 
    * Update SECURITY.md

* Update SECURITY.md
    Classic298 · 2026-05-09 01:19:30 +09:00
    1f977d072e
  • Merge pull request #24356 from Classic298/patch-1 
    doc/chore: Update SECURITY.md
    Classic298 · 2026-05-05 03:45:57 +09:00
    4e6a7baab7
  • sec (#22897)
    Classic298 · 2026-03-20 15:47:50 -05:00
    c81b3ef9ce
  • doc: sec
    Timothy Jaeryang Baek · 2026-03-15 17:16:18 -05:00
    7611762e04
  • feat: experimental open terminal integration
    Timothy Jaeryang Baek · 2026-02-25 15:15:53 -06:00
    636ab99ad8
  • Update SECURITY.md (#21859)
    Classic298 · 2026-02-25 12:55:20 -06:00
    e3f21d6c3b
  • chore: format
    Timothy Jaeryang Baek · 2025-11-06 16:44:33 -05:00
    49d57ae82b
  • chore: format
    Timothy Jaeryang Baek · 2025-11-06 16:39:07 -05:00
    0d0a37c884
  • chore: format
    Timothy Jaeryang Baek · 2025-11-06 03:51:26 -05:00
    224e4c3a61
  • Revise SECURITY.md for improved clarity 
    Updated security reporting guidelines for clarity and structure.
    Classic298 · 2025-11-06 08:43:56 +01:00
    e4e2f8352c
  • chore: format
    Timothy Jaeryang Baek · 2025-10-26 19:33:39 -07:00
    a70bc52c34
  • Patch 1 (#22)
    Classic298 · 2025-10-17 11:32:17 +02:00
    a483d41de2
  • chore: format
    Timothy Jaeryang Baek · 2025-10-16 11:36:26 -05:00
    fd0e9652a8
  • Update SECURITY.md
    Classic298 · 2025-10-12 17:24:38 +02:00
    e41836f8bd
  • Update SECURITY.md
    Classic298 · 2025-10-12 17:23:23 +02:00
    0417a456c3
  • chore: expand SECURITY.MD once again
    Classic298 · 2025-10-12 17:08:13 +02:00
    3fc29b292c
  • Update SECURITY.md
    Classic298 · 2025-10-09 09:03:36 +02:00
    8ca4596918
  • Update SECURITY.md
    Timothy Jaeryang Baek · 2024-08-19 09:18:40 -05:00
    ec99ac7121
  • chore: format
    Timothy J. Baek · 2024-08-07 14:51:07 +02:00
    40ecc2563a
  • Update SECURITY.md
    Justin Hayes · 2024-08-06 15:08:37 -04:00
    35115957d8
  • Update SECURITY.md
    Justin Hayes · 2024-08-06 14:57:07 -04:00
    b193eb1d82
  • rename to open-webui
    Timothy J. Baek · 2024-02-16 23:30:38 -08:00
    90bcd1644a
  • Rename SECURITY.md to docs/SECURITY.md 
    Moved Security.md to /docs Will still show up on the GH security tab.
    Doug Winzell · 2024-01-25 07:54:18 -08:00
    ca188b14ab