Skip to main content
FIM One takes security seriously. If you discover a vulnerability, we want to hear about it — and we will credit you for responsible disclosure.

​
Reporting Vulnerabilities

Do NOT open a public GitHub issue for security vulnerabilities. Use one of the private channels below.
Two ways to report:
  1. GitHub Security Advisories (preferred) — Create a private advisory. Only maintainers can see it until a fix is released.
  2. Email — Send details to security@fim.ai with a description, reproduction steps, affected versions, and impact assessment.
For low-severity issues (e.g., missing security headers that don’t expose sensitive data), you may open a regular GitHub issue with the security label.

​
Response Timeline

​
Scope

​
In scope

  • Authentication and authorization bypass
  • SQL injection, command injection, or code execution
  • Cross-site scripting (XSS) or cross-site request forgery (CSRF)
  • Credential or API key exposure
  • Privilege escalation between users or organizations
  • Data leakage across tenant boundaries

​
Out of scope

  • Vulnerabilities in third-party dependencies (report upstream; we monitor via Dependabot)
  • Social engineering attacks
  • Denial of service (DoS) without a realistic attack vector
  • Issues in the demo/cloud environment that don’t affect self-hosted deployments

​
Self-Hosted Security Best Practices

If you are running FIM One on your own infrastructure, follow these recommendations to harden your deployment.
These practices apply to production deployments. For local development, the defaults are fine.

​
Security Hall of Fame

We credit all confirmed vulnerability reporters (unless they prefer to remain anonymous). Reporters also qualify for the Pioneer Program.

​
Full Security Policy

This page summarizes the key points. For the complete security policy, see SECURITY.md on GitHub.