onedrive/security.md

Security Policy

Supported Versions

Security fixes are generally provided through new releases of the latest maintained version of the OneDrive Client for Linux.

Older versions may not receive security updates. Users are encouraged to run the latest available release.

Reporting a Vulnerability

If you believe you have discovered a security vulnerability in the OneDrive Client for Linux, please report it privately using GitHub's Report a vulnerability facility:

https://github.com/abraunegg/onedrive/security/advisories

Please do not initially disclose suspected vulnerabilities through public GitHub Issues, Discussions or Pull Requests.

When submitting a report, please include:

• A clear description of the suspected vulnerability.
• The affected client version or Git commit.
• Steps to reproduce the issue.
• The potential security impact and conditions required for exploitation.
• Any relevant logs or proof-of-concept information, with credentials, tokens and personal information removed.
• Any suggested remediation, if available.

Vulnerability Assessment

Reports will be reviewed to determine whether they represent an exploitable security vulnerability, a defence-in-depth improvement, or a general software defect.

Not all security-related improvements necessarily constitute vulnerabilities requiring a security advisory.

The maintainer may request additional information or validation before determining the appropriate course of action.

Coordinated Disclosure

Confirmed vulnerabilities will be addressed as appropriate based on their severity, impact and practical exploitability.

Where appropriate, fixes may be developed privately using GitHub Security Advisories before being published.

Public disclosure should be coordinated with the maintainer to provide users with a reasonable opportunity to update.

Security advisories may be published for confirmed vulnerabilities where warranted.

Maintenance

This project is independently maintained. Security reports are taken seriously, but no guaranteed response or remediation timeframe is provided.