This policy applies to every repository of the gofiber organization that does not have a SECURITY.md of its own.

1. Supported versions
2. Reporting a vulnerability
3. What happens after you report
4. Security points of contact
5. Incident response process
6. Secure accounts with access
7. Critical updates and security notices

Security fixes are released for the latest release of every module. Upgrade to it to receive the fix.

Some repositories hold several Go modules that are versioned and released on their own, for example gofiber/contrib, gofiber/storage and gofiber/template. There a fix is published as a new release of the affected module only. The latest releases are listed on the Releases page of each repository.

You do not need to find out first whether your version is still supported. Report the problem and tell us the module and version you use.

Do not open a public issue, discussion or pull request for a security problem. Report it privately instead:

1. GitHub private vulnerability reporting (preferred). Open the Security tab of the affected repository and click Report a vulnerability. The form is at https://github.com/gofiber/<repository>/security/advisories/new. Only you and the maintainers can see the report.
2. E-mail. Send the report to rene@gofiber.io.
3. Discord. Join our server via this invite link and send a private message to one of the maintainers. Do not post any details in public channels.

Please include as much of the following as you can:

• the affected repository, module and version (or commit)
• a description of the problem and its impact
• the steps or a minimal proof of concept to reproduce it
• a suggested fix, if you have one

• We confirm that we received the report and assess it together with you.
• We prepare the fix privately and release it for all affected supported versions.
• We publish a GitHub Security Advisory for the affected repository and request a CVE ID for it.
• We credit you as the reporter in the advisory, unless you prefer to stay anonymous.

Please keep the problem confidential until the advisory is published.

For security-related matters, please contact any of the maintainers through the channels listed under Reporting a vulnerability.

The maintainers are the only persons with administrative access to the source code of the gofiber repositories and respond to security incident reports as fast as possible, within one business day at the latest.

In case an incident is discovered or reported, we will follow this process to contain, respond and remediate:

The first step is to find out the root cause, nature and scope of the incident.

• Is the incident still ongoing? If yes, prioritize stopping it.
• Is the incident outside our influence? If yes, prioritize containment.
• Find out who knows about the incident and who is affected.
• Find out what data was potentially exposed.

After the initial assessment and containment to our best abilities, we will document all actions taken in a response plan.

We will create a comment in the official #announcements channel to inform users about the incident and what actions we took to contain it.

Once the incident is confirmed to be resolved, we will summarize the lessons learned from the incident and create a list of actions we will take to prevent it from happening again.

The gofiber organization requires 2FA authorization for all of its members.

We learn about critical software updates and security threats from these sources:

1. GitHub Security Alerts and Dependabot
2. GitHub: githubstatus.com and @githubstatus