{"action":"created","issue":{"url":"https://api.github.com/repos/impresspages/ImpressPages/issues/667","labels_url":"https://api.github.com/repos/impresspages/ImpressPages/issues/667/labels{/name}","comments_url":"https://api.github.com/repos/impresspages/ImpressPages/issues/667/comments","events_url":"https://api.github.com/repos/impresspages/ImpressPages/issues/667/events","html_url":"https://github.com/impresspages/ImpressPages/issues/667","id":54127501,"number":667,"title":"How secure is ImpressPages ?","user":{"login":"santo74","id":7080464,"avatar_url":"https://avatars.githubusercontent.com/u/7080464?v=3","gravatar_id":"","url":"https://api.github.com/users/santo74","html_url":"https://github.com/santo74","followers_url":"https://api.github.com/users/santo74/followers","following_url":"https://api.github.com/users/santo74/following{/other_user}","gists_url":"https://api.github.com/users/santo74/gists{/gist_id}","starred_url":"https://api.github.com/users/santo74/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/santo74/subscriptions","organizations_url":"https://api.github.com/users/santo74/orgs","repos_url":"https://api.github.com/users/santo74/repos","events_url":"https://api.github.com/users/santo74/events{/privacy}","received_events_url":"https://api.github.com/users/santo74/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-13T00:05:06Z","updated_at":"2015-01-13T08:39:20Z","closed_at":null,"body":"How secure is ImpressPages and more interestingly: what precautions are being taken to make IP as secure as possible ?\r\nAre there any security audits performed ?\r\nIs there a release strategy in place regarding security related fixes ?\r\n\r\nI understand security is a complex matter but some indications would be very interesting.\r\n\r\nAccording to [this site](http://www.cvedetails.com/product/23363/Impresspages-Impresspages-Cms.html?vendor_id=12377) there was only 1 vulnerability detected in the past, which is obviously a very good score, but if there aren't any audits or other security related tests, then that score probably doesn't tell us that much.\r\nAlso, there might be other vulnerabilities that were not included in this database.\r\nE.g. I found [this link](http://osvdb.org/show/osvdb/99274) as well, which refers to an exploit that was never included in the cvedetails database."},"comment":{"url":"https://api.github.com/repos/impresspages/ImpressPages/issues/comments/69711666","html_url":"https://github.com/impresspages/ImpressPages/issues/667#issuecomment-69711666","issue_url":"https://api.github.com/repos/impresspages/ImpressPages/issues/667","id":69711666,"user":{"login":"jankus","id":564633,"avatar_url":"https://avatars.githubusercontent.com/u/564633?v=3","gravatar_id":"","url":"https://api.github.com/users/jankus","html_url":"https://github.com/jankus","followers_url":"https://api.github.com/users/jankus/followers","following_url":"https://api.github.com/users/jankus/following{/other_user}","gists_url":"https://api.github.com/users/jankus/gists{/gist_id}","starred_url":"https://api.github.com/users/jankus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jankus/subscriptions","organizations_url":"https://api.github.com/users/jankus/orgs","repos_url":"https://api.github.com/users/jankus/repos","events_url":"https://api.github.com/users/jankus/events{/privacy}","received_events_url":"https://api.github.com/users/jankus/received_events","type":"User","site_admin":false},"created_at":"2015-01-13T08:39:20Z","updated_at":"2015-01-13T08:39:20Z","body":"Before major releases we go through bug bounty program. Which means we pay our money for everyone who founds a security issue. When everything is fixed, only then release is published.\r\n\r\nWe always ask community and other developers to check from their perspective for possible security issue. If something is found we immediately release a fix. If website owners allow us to contact them, we send security notification through email.\r\n\r\nIs that good enough? Do you have any other suggestions?"}}