This repository builds openwhistle.net and its image ghcr.io/openwhistle/website; the policy below is OpenWhistle's. Report a weakness of the website or its image the same way, through OpenWhistle's private vulnerability reporting (this repository has none of its own). For the website, only its main branch, as deployed, is supported.

Security fixes are released for the latest published version. Always run the most recent release; see the releases page and the in-app Admin → System page for update status.

Please report vulnerabilities privately — do not open a public issue.

• Preferred: GitHub's private vulnerability reporting ("Report a vulnerability" on the Security tab).

Because OpenWhistle protects whistleblowers, we especially value reports about anonymity leaks, authorization/tenant-isolation bypasses, and anything that could deanonymize a reporter. We aim to acknowledge reports promptly and will credit reporters (with their consent) in the advisory and here.

You may test OpenWhistle and report what you find. There is no payment: OpenWhistle is a volunteer project, and every report serves the people who rely on it. With your consent, we credit you in the advisory and below. Test on your own installation, never on the public demo's other visitors.

OpenWhistle is maintained in spare time; these are commitments, and when one slips you hear why.

Our thanks to those who have responsibly disclosed security issues:

• @openblow — reported the four advisories fixed in v1.1.1 (report object-level authorization / deanonymization, privilege escalation, stored XSS, and weak/duplicated HTTP security headers).