Only the latest stable version receives security patches. It is recommended to always deploy from main or the latest release.

Use GitHub's private reporting feature:

Report a vulnerability

You will receive an acknowledgment within 48 hours.

To speed up processing, please specify:

• Affected version — tag or commit hash
• Component — deploy.sh, haproxy.cfg, nextcloud-init.sh, etc.
• Description — nature of the vulnerability and potential impact
• Reproduction — minimal steps to reproduce
• Suggested fix — if you have one (optional)

• deploy.sh — secret generation, permission management, deployment logic
• haproxy.cfg — filtering rules, TLS configuration, security headers
• nextcloud-init.sh — post-installation configuration, credential management
• docker-compose.yml / generated templates — port exposure, volume mounts
• nextcloud-custom.config.php — sensitive Nextcloud configuration
• Any configuration that would expose user data or allow unauthorized access

• Vulnerabilities in upstream Docker images (nextcloud, haproxy, collabora/code, redis, rustfs/rustfs…) — report directly to the relevant publishers
• Vulnerabilities in Nextcloud itself — Nextcloud Security
• Vulnerabilities in Collabora CODE — Collabora Security
• Configuration specific to the user's environment (weak passwords, misconfigured DNS…)

This project natively integrates the following protections:

Once the fix is deployed in a release, a GitHub Security Advisory will be published with:

• The vulnerability description
• Affected versions
• Mitigation measures
• Credit to the reporter (unless anonymity is requested)

Thank you for contributing to the security of this project.