mirror of
https://github.com/traefik/traefik.git
synced 2026-05-05 04:16:25 +02:00
80 lines
4.1 KiB
Markdown
80 lines
4.1 KiB
Markdown
---
|
|
title: "Traefik Security Documentation"
|
|
description: "Security is a key part of Traefik Proxy. Read the technical documentation to learn about security advisories, CVE, and how to report a vulnerability."
|
|
---
|
|
|
|
# Security
|
|
|
|
## Security Advisories
|
|
|
|
We strongly advise you to join our mailing list to be aware of the latest announcements from our security team.
|
|
You can subscribe by sending an email to security+subscribe@traefik.io or on [the online viewer](https://groups.google.com/a/traefik.io/forum/#!forum/security).
|
|
|
|
## CVE
|
|
|
|
Reported vulnerabilities can be found on
|
|
[cve.mitre.org](https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=traefik).
|
|
|
|
CVEs are only created for vulnerabilities affecting **Generally Available (GA) versions** of Traefik.
|
|
Vulnerabilities discovered in non-GA versions (release candidates, betas, early access, or development branches)
|
|
will be fixed without creating a CVE.
|
|
|
|
## Report a Vulnerability
|
|
|
|
We want to keep Traefik safe for everyone.
|
|
If you've discovered a security vulnerability in Traefik,
|
|
we appreciate your help in disclosing it to us in a responsible manner,
|
|
by creating a [security advisory](https://github.com/traefik/traefik/security/advisories).
|
|
|
|
## Code of Conduct for Vulnerability Submissions
|
|
|
|
We are committed to handling every legitimate report responsibly,
|
|
and we expect submitters to engage with our security team in a respectful and collaborative manner.
|
|
|
|
The following behaviors are **not acceptable** and will not be tolerated:
|
|
|
|
- **Threats** to publicly disclose the vulnerability if it is not fixed within a timeframe you set unilaterally.
|
|
- **Ultimatums** or pressure tactics intended to force a faster response than our normal triage and remediation process allows.
|
|
- **Demands** for payment, bug bounties, or any form of compensation in exchange for not disclosing the issue
|
|
(Traefik does not operate a paid bug bounty program).
|
|
- **Aggressive, abusive, or disrespectful communication** with our security team.
|
|
|
|
Submitters who engage in any of the above may face the following consequences:
|
|
|
|
- The submitter **will not be credited** in the security advisory or any subsequent communication.
|
|
- The submitter's GitHub profile may be **reported to GitHub** for violation of platform terms of service.
|
|
- We may **decline to engage further** on the report, while still addressing the underlying issue if it is legitimate.
|
|
|
|
We take security seriously and act on legitimate reports as quickly as our resources allow.
|
|
Patience and constructive dialogue help us protect users effectively.
|
|
|
|
## Submission Quality Guidelines
|
|
|
|
We have been receiving an increasing number of low-quality vulnerability reports that are not actual security issues.
|
|
Many of these reports originate from AI/LLM tools and are submitted without any human validation or testing.
|
|
This wastes the time of our security team and delays the handling of legitimate vulnerabilities.
|
|
|
|
Before submitting a security advisory, you **must**:
|
|
|
|
- **Carefully test and validate** the vulnerability yourself before submitting.
|
|
You must be able to demonstrate a working proof of concept with clear reproduction steps.
|
|
- **Understand the impact** of the vulnerability and explain how it can be exploited in a realistic scenario.
|
|
- **Verify that the issue is not a false positive**.
|
|
Ensure the behavior you are reporting is actually a security concern and not expected behavior.
|
|
|
|
### Policy on AI-Generated Reports
|
|
|
|
Security reports that are **directly generated by AI/LLM tools without proper human validation** will be **closed immediately**.
|
|
|
|
Indicators of unvalidated AI-generated reports include (but are not limited to):
|
|
|
|
- No working proof of concept or reproduction steps.
|
|
- Generic or theoretical vulnerability descriptions with no evidence of actual testing.
|
|
- Misunderstanding of Traefik's architecture or threat model.
|
|
- Hallucinated code paths, configuration options, or behaviors that do not exist.
|
|
|
|
**Contributors who repeatedly submit low-quality or unvalidated reports may have their accounts blocked.**
|
|
|
|
We appreciate the work of security researchers who take the time to rigorously validate their findings.
|
|
Quality over quantity helps keep Traefik safe for everyone.
|