| Version | Supported |
|---|---|
| 2.2.x | ✅ |
| 2.1.x | ✅ |
| 2.0.x | ✅ |
| 1.3.x | ✅ |
| ≤ 1.2 | ❌ |
Note maturité : « Supported » ici = versions pour lesquelles nous acceptons des rapports de sécurité, pas « production-ready ». Voir docs/MATURITY.md. | Version | Supported | | ------- | --------- | | 2.4.x | ✅ | | 2.3.x | ✅ | | < 2.3 | ❌ |
Do not open a public GitHub issue for security vulnerabilities.
Report only via GitHub Security Advisories (preferred):
- Description of the vulnerability
- Steps to reproduce
- Affected versions and components
- Potential impact
- Suggested fix (if any)
| Step | Target |
|---|---|
| Acknowledgement | 48 hours |
| Initial assessment | 7 days |
| Fix or mitigation plan | 30 days |
| Public disclosure | After patch release |
- Plugin loading is confined to
--plugin-dir(path jail). Prefer aplugins.allowSHA-256 allowlist for production installs. - Do not expose
publicBindP2P without a session auth key (PeerEncryption/--wan-codefor the WAN QA hub). - See docs/PRODUCTION.md for the production / experimental matrix.