From d34a58eb5f64f965d93e83bae90ad9035d777d13 Mon Sep 17 00:00:00 2001 From: Dewi Roberts Date: Tue, 7 Apr 2026 12:00:26 +0100 Subject: [PATCH] security: add item to intended behavior section of security policy (#21430) Add section --- SECURITY.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 08a2ba6558..7148e39050 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -18,10 +18,10 @@ Even if the issue is not a CVE, we still greatly appreciate your help in hardeni (.x being the latest patch release for each version) -| Version | Supported | -| ---------- | ---------- | -| 2025.12.x | ✅ | -| 2026.2.x | ✅ | +| Version | Supported | +| --------- | --------- | +| 2025.12.x | ✅ | +| 2026.2.x | ✅ | ## Reporting a Vulnerability @@ -90,6 +90,10 @@ Prompts intentionally allow raw HTML, including script tags, so they can be used Redirects that only change navigation flow and do not expose session tokens, API keys, or other confidential data are considered acceptable and do not require reporting. +- Outgoing network requests are not filtered. + +The destinations of outgoing network requests (HTTP, TCP, etc.) made by authentik to configurable endpoints through objects such as OAuth Sources, SSO Providers, and others are not validated. Depending on your threat model, these requests should be restricted at the network level using appropriate firewall or network policies. + ## Disclosure process 1. Report from Github or Issue is reported via Email as listed above.