Report issues
privately.
We accept security reports through a private disclosure policy. This lets us patch vulnerabilities before making them public.
Supported versions
Only the latest release is actively supported for security fixes. We do not maintain legacy branches for security patches.
Report details
Include affected versions and steps to reproduce. Response and resolution times depend on severity and available information.
Private disclosure
Do not open public GitHub issues for security vulnerabilities. Use the private draft advisory path instead.
High-severity examples
Vulnerabilities that trigger an advisory and prioritized fix.
Extracting raw face images or biometric templates unexpectedly
Bypassing tenant isolation or cryptographic protections
Reading another organization's Cloud data through a tenant-isolation bug
Modifying attendance or audit data without authorization
Protection scope
This policy covers the open-source Facenox Desktop core and its integration points. Live remote environments and hosting systems are governed by their own security policies.