We take security seriously and welcome reports from the community. This document describes how to report a vulnerability and what to expect in return.
Do not open a public GitHub issue for security problems. Public disclosure before a fix is shipped puts every Errlyorbit deployment at risk.
You have two private channels:
- Open this repo's Security tab.
- Click Report a vulnerability.
- Fill in the form. Only repo maintainers see the report.
Send a report to security@errlyorbit.com.
Optional but appreciated: encrypt with our PGP key.
PGP key fingerprint: TODO — generate before first public release
PGP key URL: https://errlyorbit.com/.well-known/security-pgp.asc
(Until the PGP key is published, plain email is fine. The mailbox is restricted to the maintainer.)
The more we have, the faster we can ship a fix.
- Errlyorbit version (footer of any page or
GET /api/health/). - Docker image tag (
docker images errlyorbit/errlyorbit). - Affected component (ingest endpoint, worker, dashboard, source-map upload, alerting, …).
- Concrete impact (information disclosure / RCE / privilege escalation across orgs / DoS amplification / …) and a CVSS estimate if you have one. Don't worry if you don't — we'll score it.
- Proof-of-concept or repro steps. Self-contained scripts are ideal.
- Whether the issue is exploitable from an unauthenticated client or requires an authenticated session.
- Your name and an attribution preference (acknowledged in the fix release notes / anonymous / pseudonym).
| Target | |
|---|---|
| Acknowledgement of receipt | within 3 business days |
| Initial assessment (severity, applicability) | within 7 business days |
| Patch release for critical issues | within 30 days of confirmed report |
| Public disclosure (advisory + CVE if applicable) | coordinated, at most 90 days after report |
These are best-effort targets, not contractual SLAs. Critical issues (unauthenticated RCE, cross-org data leak) are handled out-of-band and typically ship faster.
We follow a 90-day coordinated disclosure window. After we acknowledge a report:
- We assess severity and reproducibility.
- We develop and test a fix.
- We ship a patched Docker image (
errlyorbit/errlyorbit:X.Y.Z) and notify operators via the changelog. - 30 days after the patch release (or sooner, by mutual agreement) we publish a security advisory in this repository describing the issue, affected versions, and credits.
- If we cannot ship a fix within 90 days, we'll communicate the delay and expected timeline. Reporters retain the right to publish if we miss the window — we'd rather you publish a fixed bug than sit on one indefinitely.
The following are not considered security issues for this project:
- Findings that require physical access to the host running Errlyorbit.
- DoS-by-volume against the public ingest endpoint (it's designed to return 429 under load — that's the always-200 contract intentionally shedding traffic).
- Misconfigurations in the operator's own deployment (weak
NEXTAUTH_SECRET, public Postgres exposed to the internet, etc.). - Vulnerabilities in third-party dependencies that don't affect Errlyorbit's exposed surface — please report those upstream first.
- Theoretical attacks without a working PoC.
If you're not sure whether something qualifies, err on the side of reporting. We'll decide.
This policy covers:
- The Errlyorbit Docker image (
errlyorbit/errlyorbit:*) on Docker Hub. - The marketing website https://errlyorbit.com.
- The public install assets (
/docker-compose.yml,/.env.example).
It does not cover:
- The Sentry SDKs themselves — report those to https://github.com/getsentry.
- Postgres, MinIO, Cloudflare R2, AWS S3, or any operator-chosen infrastructure — report those to the respective vendors.
We do not currently offer monetary bounties. Reporters are credited in the security advisory and the changelog (with their consent).
Security researchers who have responsibly disclosed issues will be listed here once we ship our first fix.
(Empty for now — be the first.)