Report a vulnerability

Found a security vulnerability in our software or on this website? Thank you for telling us. This page explains how to report it, what happens next, and how long our software receives security updates.

• Software we develop and ship, including our DokuWiki extensions
• This website, www.wvds.it

For vulnerabilities in other vendors' software, such as DokuWiki itself or third-party extensions, please contact that vendor.

Use the form to tell us what is affected, how to reproduce the issue, and what an attacker could achieve with it. Your email address is optional, but without it we can't reply to you.

We ask that you:

• Don't access, modify, or delete other people's data while testing.
• Don't disrupt the service, for example with load or denial-of-service tests.
• Keep the vulnerability to yourself until it's fixed or the deadline below has passed.

1. Receipt: You get a reference number (SR-…) right away. Your report is emailed to all administrators of this website.
2. Acknowledgment: If you gave an email address, we acknowledge your report within 10 business days.
3. Fix: We fix the vulnerability in the current version.
4. Disclosure: As soon as the fixed version is available, we publish a security advisory. We disclose the vulnerability no later than 90 days after your report, even if no fix is available yet, unless we agree on a different timeline with you.

Our DokuWiki extensions receive security updates for five years from their release. Fixes ship in the current version. If you bought an earlier version, you get the current one free of charge.

We publish security advisories for our DokuWiki extensions on this page. None have been published so far.

Our contact and policy are also available in machine-readable form at /.well-known/security.txt (RFC 9116).