Vulnerability reporting

Do not use public issues

Security vulnerabilities must not be filed as public GitHub issues or discussed in Discord before coordination.

Report privately

1. GitHub private vulnerability reporting on the affected repository:

   • turbopanel — control plane
   • turbopaneld — daemon
   • ui — console
   • website — docs site
   • dev — contributor tooling

2. Email security@turbopanel.io if GitHub private reporting is unavailable.

Marketing summary: turbopanel.io/security.

Include

• Component and deployment type (TurboPanel High Availability vs self-hosted)
• Version, OS, architecture
• Reproduction steps and impact
• Minimal proof-of-concept when possible

Our process

We publish advisories on GitHub Security Advisories after a fix or mitigation is available. Reporters are credited unless they request anonymity.

Supported versions

Security fixes target the current release channel. See Security for the support table.