Skip to main content

Reporting a vulnerability

We take the security of Ticketra seriously. If you believe you've found a vulnerability, please disclose it responsibly.

How to report​

  • Do not open a public GitHub issue for security problems.
  • Email the security contact published at ticketra.net (e.g. security@ticketra.net), or use the channel listed in the project's SECURITY.md.
  • Encrypt sensitive details if a PGP key is provided.

What to include​

  • A clear description of the issue and its impact.
  • Steps to reproduce (proof-of-concept if possible).
  • Affected version(s) and configuration.
  • Your assessment of severity, if you have one.

What to expect​

  • Acknowledgement of your report.
  • An assessment and, where warranted, a coordinated fix.
  • A disclosure window so deployments can patch before details are public.
  • Credit for the finding, if you'd like it.

Scope guidance​

Especially valuable reports include: authentication/authorization bypass, tenant-isolation breaks, injection (SQL, command, etc.), and secret exposure. Please test only against your own deployment — never against another tenant or a system you don't control.

For operators​

Harden your deployment using the Hardening guide and keep dependencies patched. Consider publishing a security.txt (at /.well-known/security.txt) for your own deployment so researchers know how to reach you.