Please do not open a public issue for security problems.
Report them privately through GitHub's private vulnerability reporting on this repository ("Security" → "Report a vulnerability"). Include:
- the affected package(s) and version(s)
- how to reproduce it: a config and the requests, or a failing test
- the impact you see (what an attacker can read, change or break)
| When | What |
|---|---|
| Within 7 days | We confirm we received it and whether we can reproduce it |
| Within 30 days | A fix is released, sooner for issues that are easy to exploit; if it takes longer we tell you why and when |
| With the fix | A GitHub security advisory (with a CVE when it qualifies), crediting you unless you prefer otherwise |
Please keep the details private until the advisory is published. Fixes are released as patch
versions of every @easy-cms/* package, which share one version number.
| Version | Security fixes |
|---|---|
| Latest 1.x minor | ✅ |
| Older 1.x minors | ❌ upgrade to the latest minor (no breaking changes within 1.x) |
| 0.x | ❌ upgrade to 1.x |
Fixes go to the latest minor release. Once 2.0 is out, the latest 1.x minor keeps getting them for six months. See versions and deprecations.
In scope: the published packages (@easy-cms/*, easy-cms, create-easy-cms), including the
admin UI, the REST API, authentication, access control and file uploads.
Out of scope:
- access rules or hooks in your own config that allow more than you meant (report it if a documented rule doesn't do what the docs say)
- the example apps in
examples/, which are demos - vulnerabilities in dependencies with no path to exploit them through Easy CMS (still welcome as a regular issue)
- denial of service through very large volumes of requests; put a rate limiter or CDN in front
The security guide lists what Easy CMS does (password hashing, login rate limiting, CSRF and origin checks, upload sandboxing) and what to set up in production.
- OWASP ASVS level 1 review (October 2026): what was found and the release that fixed each.