Security Policy

Thelia is free and open source software stewarded by OpenStudio. This page describes the security lifecycle of the project: how vulnerabilities are reported, how fixes are developed and released, and how you are informed.

The canonical disclosure policy — contact, scope, response targets and supported versions — lives in the repository: SECURITY.md.

Reporting a vulnerability

Never use a public issue, discussion or pull request for a security problem. Report it privately:

• Preferred: open a private report from the Security tab of the affected repository ("Report a vulnerability").
• Or email contact@thelia.net with [SECURITY] in the subject line.

We acknowledge reports within 72 hours, triage within 7 days, and aim to release a fix for a confirmed vulnerability within 90 days. Disclosure is coordinated with the reporter: details stay confidential until a fixed release is available.

How a fix is developed

1. The report is triaged privately by the maintainers: impact, affected components, affected series.
2. The fix is developed in a private workspace (GitHub draft security advisory and its temporary private fork), so nothing leaks before the release.
3. Like any change to Thelia, the fix is reviewed by a maintainer and must pass the full test suites and static analysis before it is merged.
4. The fix is applied to every supported series (currently 3.0 and 2.6).

How a fix is released

Security fixes ship as regular patch releases on each supported series — there is no separate hotfix channel. Each release is:

• tagged on GitHub with a GitHub release, which makes it available through Packagist immediately,
• accompanied by a CycloneDX SBOM (software bill of materials) generated from composer.lock and attached to the GitHub release.

How you are informed

• A GitHub Security Advisory is published on the affected repository once the fixed release is available, with a CVE identifier requested through GitHub for vulnerabilities affecting released versions.
• The release notes of the fixed version reference the advisory.

To stay informed, watch the thelia/thelia repository (Watch → Custom → Security alerts) and enable Dependabot alerts on your own project so GitHub warns you when a Thelia package you depend on is affected by a published advisory.

Regulatory reporting

Thelia is stewarded by OpenStudio as an open source software steward within the meaning of article 24 of the EU Cyber Resilience Act (regulation 2024/2847), not as a manufacturer: no CE marking and no conformity assessment apply. What does apply is a coordinated vulnerability disclosure policy, cooperation with market surveillance authorities, and the notification of actively exploited vulnerabilities and severe incidents.

Two situations trigger a notification: a vulnerability under active exploitation (exploitation observed in the wild, not a theoretical report), and a severe incident affecting the development or distribution infrastructure, such as a compromise of the GitHub organisations, of the release pipeline, or of the published packages.

Notifications go to the ENISA single reporting platform, which routes them to the coordinating CSIRT of the member state (CERT-FR for France), on the article 14 timeline:

Deadline	Notification
24 hours from awareness	Early warning
72 hours from awareness	Vulnerability or incident notification, with severity, impact and mitigations
14 days from the fix being available	Final report (one month for a severe incident)

The reporting obligations of the regulation apply from 11 September 2026. The full process, including the internal checklist, lives in docs/security/cra-incident-response.md in the main repository.

note

Notification duties sit with the steward. They never delay the fix: the remediation work runs in parallel, and a release is not held back waiting for a notification.

Keeping your installation secure

• Stay on the most recent release of your series: security fixes only target the latest 3.0 and 2.6 versions.
• Run composer audit regularly (or in your CI): it checks every installed package, Thelia included, against known security advisories.
• Report anything suspicious privately, as described above.

See also

• Personal data: export, anonymization and retention of customer data.