generated: '2026-08-27'
method: searched
source: https://github.com/mealie-recipes/mealie/blob/mealie-next/SECURITY.md
docs: https://github.com/mealie-recipes/mealie/security/policy
program:
  published: true
  type: coordinated-disclosure
  channel: GitHub private vulnerability reporting
  intake_url: https://github.com/mealie-recipes/mealie/security/advisories/new
  policy_url: https://github.com/mealie-recipes/mealie/security/policy
  policy_file: https://github.com/mealie-recipes/mealie/blob/mealie-next/SECURITY.md
  http_status_probed: 200
  bug_bounty: false
  platform: null
  safe_harbor_statement: false
  response_sla: null
  pgp_key: null
supported_versions:
  policy: latest release only
  quoted: >-
    "Since this software is still considered beta/WIP support is always only given for
    the latest version. Security patches are only available for the latest version and
    not back-ported to older versions."
security_txt:
  present: false
  probed:
  - url: https://mealie.io/.well-known/security.txt
    status: 404
  - url: https://docs.mealie.io/.well-known/security.txt
    status: 404
  - url: https://demo.mealie.io/.well-known/security.txt
    status: 200
    result: miss
    note: SPA catch-all returning the HTML application shell, not a security.txt.
  note: >-
    RFC 9116 security.txt is the one cheap thing missing here. The policy itself is
    real and reachable — it is simply not discoverable at the machine-readable path an
    automated scanner would look for.
published_security_guidance:
  url: https://docs.mealie.io/documentation/getting-started/installation/security/
  http_status_probed: 200
  note: >-
    Unusually candid for a self-hosted project: Mealie documents its own attack
    surface rather than only accepting reports about it. It names three endpoints
    (/api/recipes/create/url, /api/recipes/create/ai, /api/recipes/{id}/image) as DoS
    and SSRF vectors, explains why (server-side fetch of a caller-supplied URL),
    states that the API ships with NO rate limiting, and gives operators concrete
    mitigations at Traefik, Nginx and Caddy plus container network isolation.
  documented_risks:
  - class: denial-of-service
    vector: Concurrent scrape requests against an arbitrarily large remote file.
    mitigation: Reverse-proxy rate limits, strict on the three named endpoints.
  - class: server-side-request-forgery
    vector: Caller-supplied URLs fetched by the server can reach internal network resources.
    mitigation: Network-isolate the container; allow outbound internet only.
transparency:
  advisories_url: https://github.com/mealie-recipes/mealie/security/advisories
  note: Published advisories, if any, appear on the repository's Security tab.