Security
Security and support policy
Which versions of Cleitext get fixes, how to tell us about a vulnerability and how the fix reaches your site.
A few words first
We publish new versions of Cleitext very often, sometimes several in a day. Each one is a safe update: it is tried before your site switches to it, and you can always go back. So we count versions like this:
- A release is a minor version with its patches: for example 0.64.0, 0.64.1, 0.64.2… From 1.0 on, the same: 1.4.0, 1.4.1…
- A release line is a major version. Before 1.0 the whole 0.x series is one line; from 1.0 each major version (1.x, 2.x…) is a line of its own.
Why not a promise for every minor version? With several a day it would not be a promise we could keep, and you never need it: moving to the latest release is one click, with a trial run and the way back.
Supported versions
The latest release and the previous one
They get bug fixes and security fixes. For example, when 0.64 is the latest: 0.64 and 0.63. A security fix comes out as a new release and, when it applies, also as a patch of the previous release.
6 months for the previous line
When a new line comes out (1.0 after 0.x, 2.0 after 1.x), the last release of the previous line keeps getting security fixes for 6 months, so you have time to move.
Older releases are not fixed one by one: update to the latest one. It takes one click, it is tried before switching and you can go back.
The same rule covers the official plugins and themes of the catalog (the latest version and the previous one) and Cleitext Toolkit for Plesk (the latest release and the previous one; its updates come from cleitext.com).
Report a vulnerability
Found something that could put Cleitext sites at risk? Thank you: please tell us privately, never in a public issue.
- By email to [email protected], with “Security” in the subject;
- or with a private advisory on GitHub: the Report a vulnerability button in the Security tab of the repository.
Tell us the version, the steps to reproduce it and what an attacker could do. A short example helps a lot.
How fast we answer
- We confirm we got your report within 3 working days
- A first assessment within 7 days
- The fix: critical issues within 7 days, high within 14 days, medium within 30 days, low in a regular release
We keep you informed along the way.
Disclosure
We work with you on a coordinated disclosure: when the fix is out we publish an advisory on GitHub and in the release notes, and a note on the blog for serious issues. We thank you by name, unless you prefer otherwise.
We ask you to keep the details private until the fix is out, for 90 days at most.
How fixes reach your site
- Updates in the admin: when a new version is out, administrators see a notice and update with one button (or
bin/cleitext updatefrom SSH). - Safe updates: the new version is checked against its SHA-256, a backup is made, and the new version is started on the side and tried before the site switches to it. If anything fails, your site stays on the version it was running.
- Going back is one command:
cleitext rollback,cleitext plugin:rollback,cleitext theme:rollback. - Plugins and themes of the catalog update from the admin, in Plugins and Appearance → Themes.
- On Plesk, Cleitext Toolkit updates and rolls back every installation from the panel, and updates itself from cleitext.com.
Want to know how Cleitext is protected? The OWASP ASVS checklist lists the measures in place and the open items.
