# Security Policy

## Supported version
Please make sure your tine groupware is always up to date but report your vulnerability either way if it's in a recent
release or in a previous one.

## Version / Commit

Make sure you specify either the commit or the version (e.g. 2024.11.24) which is affected.

## Reporting a Vulnerability
Report vulnerabilities to:

*security@tine-groupware.de*

Please use pgp encryption for e-mail communication with our security-team.\
Our pgp key is published e.g. to https://keys.mailvelope.com. Figerprint is:\
D1E3 B9AF 10E3 D7D5 67F4 E963 6127 0D7C 7036 F259

OR

Use the GitHub "security advisories" functionality -> https://github.com/tine-groupware/tine/security/advisories

### Severity & CVSS

NOTE:
The CVSS severity does not take into account, that authenticated tine users are a "curated" user group. That means, a
critical issue might be less severe if it can only be exploited by authenticated tine accounts.