# Reporting a vulnerability

> Report a security problem in private through a GitHub security advisory.

Report security problems in private. Turmite uses GitHub private vulnerability reports on `loruorg/turmite`.

## How to report

1. Open [github.com/loruorg/turmite/security/advisories/new](https://github.com/loruorg/turmite/security/advisories/new).
2. Write a short title and a description.
3. Submit the report. Only the maintainers can see it.

You need a GitHub account. The same address is in [/.well-known/security.txt](/.well-known/security.txt).

Do not open a public issue, pull request or discussion for a security problem. Do not post it in a chat or on social media before a fix is released.

## What to include

- The Turmite version (`turmite version`) and the install method.
- The mode: `mainnet` or `testnet`.
- The affected component: merchant API, checkout, dashboard, worker, EVM contracts, SDK, WooCommerce plugin, `install.sh` or this site.
- The steps to reproduce the problem, with requests and responses if you have them.
- The impact: what an attacker can do, and what access the attacker needs first.
- A proposed fix, if you have one.

Remove real API keys, secrets, private keys and customer data from the report.

## Scope

In scope:

- The code in the `loruorg/turmite` repository.
- The container image `ghcr.io/loruorg/turmite`.
- The EVM deposit contracts in `contracts/`.
- `@turmite/sdk` and the WooCommerce plugin.
- The install script at `https://turmite.com/install.sh`.
- The site `turmite.com`.

Out of scope:

- Problems that need full control of the server first. See [Threat model](/docs/threat-model/) for what such an attacker can already do.
- Misconfiguration of a single install, for example a public dashboard without two-factor authentication.
- Third-party software and services: PostgreSQL, Caddy, Docker, RPC nodes, Trocador and the exchanges it lists. Report these to their maintainers.
- Denial of service by traffic volume.

## What happens next

1. A maintainer acknowledges the report.
2. The maintainers confirm the problem and agree on a severity with you.
3. The maintainers prepare a fix in a private fork of the advisory.
4. A new release ships the fix. The advisory is published at the same time, with credit to you if you want it.

Turmite is a community project. There is no bug bounty.

## How fixes reach operators

Each install reads the releases and security advisories of `loruorg/turmite` on GitHub once a day, unless an admin turned the check off. When an advisory affects the running version, admins see a red banner in the dashboard. When SMTP is set, admins also get an email for each critical or high advisory. To install the fix, follow [Upgrades](/docs/upgrades/).

Without a running install, watch the releases of the repository on GitHub (**Watch**, **Custom**, **Releases**) and read the [advisories](https://github.com/loruorg/turmite/security/advisories).