The OpenCRVS team takes the security of our software and deployments seriously. We welcome reports from security researchers, implementers, and members of the community who believe they have identified a security issue.
If you believe you have found a security vulnerability in OpenCRVS, please report it privately by emailing:
Please include:
- A description of the issue
- Steps to reproduce
- Affected component(s)
- Potential impact
- Any proof-of-concept code or screenshots (where appropriate)
Please do not publicly disclose suspected vulnerabilities until we have had an opportunity to investigate and, where necessary, develop and release a fix.
After receiving a report, we will:
- Acknowledge receipt of the report.
- Investigate the issue and assess its impact.
- Determine whether the report represents a security vulnerability.
- Work on remediation where appropriate.
- Keep the reporter informed of significant progress.
We aim to acknowledge reports within 5 business days. Genuine vulnerabilities will be addressed in a hotfix on the current and most recent minor release only. A GitHub Security Advisory will be published. Its important to keep OpenCRVS up-to-date
OpenCRVS is deployed in multiple environments, including development, QA, staging, and production.
Reports relating to:
- Released OpenCRVS software
- Official deployment configurations
- Default production and staging configurations
- Authentication, authorization, and data protection mechanisms
are generally considered in scope.
The following are typically considered out of scope:
- Issues affecting only local development environments
- Issues resulting solely from unsupported or intentionally insecure configurations
- Vulnerabilities in third-party infrastructure not maintained by the OpenCRVS project
- Social engineering attacks
- Reports based solely on best-practice recommendations without demonstrable impact
We support responsible and coordinated disclosure.
Where a valid security vulnerability is identified, we may publish a security advisory describing:
- The affected versions
- Severity and impact
- Remediation guidance
- Fixed versions
The timing and content of any public disclosure will be determined by the OpenCRVS maintainers.
Not all security reports result in a CVE assignment. OpenCRVS will evaluate on a case-by-case basis whether a reported issue warrants public disclosure through a CVE or other advisory mechanism.
Factors considered may include:
- Impact and severity
- Whether released versions are affected
- The number of deployments potentially affected
- Availability of mitigations or fixes
We greatly appreciate responsible security research. Researchers who report valid issues in good faith may, with their permission, be publicly acknowledged by the OpenCRVS project. Please indicate in your report whether you would like to be credited publicly.
Recognition may take the form of:
- Mention in a GitHub Discussion
- Mention in release notes
- Mention in a security advisory
Recognition on this page will be provided for:
- Genuine security vulnerabilities resulting in security advisories
Recognition is granted at the discretion of the OpenCRVS maintainers.
The OpenCRVS team would like to thank the following individuals for helping improve the security and resilience of the project.
| Researcher | Contribution | Date |
|---|---|---|