If you discover a security vulnerability, please report it privately by emailing the maintainers at:

security@freeiam.org

Please do not report security issues via GitHub Issues or other public channels.

When reporting, please include:

• A detailed description of the vulnerability
• Steps to reproduce or a proof-of-concept, if possible
• The version of the software affected
• Your contact information for follow-up questions

If a security vulnerability is confirmed and deemed significant, a CVE identifier may be requested and assigned to publicly track the issue. This helps ensure transparency and allows users and tools to easily identify and address known vulnerabilities.

We take security seriously and will respond promptly to reports.

Fixes will be prioritized and released as soon as possible. We will announce security releases via our usual channels.

• Always keep your installation up to date with the latest security patches.
• Use strong authentication credentials for LDAP bind accounts.
• Restrict access to your LDAP servers and management interfaces.
• Regularly audit your access control policies (ACLs).

This project strives to minimize its dependencies to reduce the attack surface and improve security.

We regularly monitor and update dependencies for vulnerabilities.

Please notify us if you find any insecure dependencies.

Thank you for helping us keep the project secure!