ShellHub takes security seriously. We are committed to coordinated vulnerability disclosure (CVD) as required by the EU Cyber Resilience Act (CRA) and aligned with ISO/IEC 29147.

This policy covers all components of ShellHub, including but not limited to:

• ShellHub Server (API, SSH gateway, WebSocket proxy)
• ShellHub Agent
• ShellHub CLI
• ShellHub UI
• Official container images published under shellhubio/
• ShellHub Cloud (the hosted offering)

Out of scope: third-party dependencies (report those upstream), social engineering, denial-of-service against production infrastructure, and findings from automated scanners without a demonstrated impact.

Do not publicly disclose a vulnerability until we have released a fix and published an advisory. To report:

1. Preferred: open a GitHub Security Advisory, visible to project maintainers only. Do not submit a normal issue or pull request.
2. Alternative: email security@shellhub.io with a description of the vulnerability, steps to reproduce, and any supporting material (PoC, logs, screenshots). We will confirm receipt within 2 business days.

After triage and severity assessment (using CVSS v3.1 or later), we target the following timelines from confirmation to patch release:

These are targets, not guarantees. Complex issues may take longer; if so, we will communicate an updated timeline to the reporter.

We assign a CVE identifier for every confirmed vulnerability. CVEs are requested through GitHub as a CNA, which issues them as part of the Security Advisory workflow. The CVE will be included in the published advisory.

All confirmed vulnerabilities are published as GitHub Security Advisories once a fix is available. Each advisory includes:

• A description of the vulnerability and its impact
• Affected versions
• The CVE identifier
• Remediation steps (fixed version, workarounds if any)

Users can subscribe to advisory notifications via GitHub's Watch menu on the repository.

For actively exploited vulnerabilities, we will notify the designated ENISA single reporting platform within 24 hours of becoming aware of active exploitation, provide a full vulnerability notification within 72 hours, and submit a final report within 14 days, as required by CRA Article 14.

Our internal incident response process is documented in SECURITY_INCIDENT_RESPONSE.md.

We value the work of security researchers. Unless the reporter requests anonymity, we will:

• Credit the reporter by name (or handle) in the published advisory
• Acknowledge the contribution in the release changelog

We consider security research conducted in accordance with this policy to be authorized and will not pursue legal action against researchers who:

• Act in good faith and follow this disclosure policy
• Avoid privacy violations, data destruction, and service disruption
• Do not access or modify data belonging to other users
• Report findings promptly and do not exploit them beyond what is necessary to demonstrate the issue

• Security reports: security@shellhub.io
• General questions: contact@shellhub.io