Only the current major version receives security fixes. Older majors are End of Life (EOL) and will not receive security patches.
| Version | Supported | Status |
|---|---|---|
| 4.x | ✅ | Supported (current) |
| 3.x | ❌ | End of Life — 2026-04-25 |
| 2.x | ❌ | End of Life |
| 1.x | ❌ | End of Life |
| < 1.0 | ❌ | End of Life |
Please do NOT open a public GitHub issue for security vulnerabilities.
Report security vulnerabilities via GitHub Security Advisories:
https://github.com/D-sorganization/runner-dashboard/security/advisories/new
Provide as much detail as possible: steps to reproduce, potential impact, and any suggested mitigations.
- Acknowledgement: within 48 hours of receiving the report.
- Critical vulnerabilities: patch released within 14 days.
- Non-critical vulnerabilities: patch released in the next scheduled release.
We will keep you informed as the fix progresses and credit you in the release notes unless you request otherwise.
The following are outside the scope of this security policy:
- Denial of service on self-hosted infrastructure — the dashboard runs on operator-controlled hardware; resource exhaustion attacks against that infrastructure are an operator responsibility.
- Physical access attacks — attacks that require physical access to the host machine running the dashboard.
- Issues in third-party CDN dependencies — report those to the upstream project.
- Social engineering — attacks targeting operators rather than the software.