Security: ZSvirt/zsvirt

The ZSvirt project takes security vulnerabilities seriously.

If you believe you have found a security vulnerability in ZSvirt, please report it responsibly. Do not open a public GitHub issue for security vulnerabilities.

Please contact the security team by email:

• security@zsvirt.io

If the security mailbox is not available, please contact:

• zsvirt@zstack.io

We will review the report and follow up as soon as possible.

Please include as much information as possible to help us understand, reproduce, and assess the issue.

A useful security report should include:

• A clear description of the vulnerability
• Affected repository, component, module, or feature
• Affected version, branch, commit, or build, if known
• Deployment mode and environment details
• Steps to reproduce the issue
• Proof of concept, if available
• Potential impact and attack scenario
• Logs, error messages, screenshots, or traces
• Known mitigations or workarounds
• Whether the issue has been publicly disclosed elsewhere

Please avoid sharing secrets, private keys, passwords, customer data, or unrelated sensitive information in the report.

This security policy applies to ZSvirt community repositories under the ZSvirt organization, including but not limited to:

• zvirt
• zvirt-utility
• ...

Some repositories or components may have their own security policy. If a repository contains a separate SECURITY.md, please follow the policy in that repository.

The following issues are usually not considered security vulnerabilities unless they demonstrate a clear security impact:

• General bugs without a security impact
• Missing security headers in non-production documentation sites
• Social engineering attacks
• Denial-of-service reports without practical exploitability
• Vulnerabilities in unsupported versions
• Issues that require full administrative access without privilege escalation
• Reports from automated scanners without analysis or reproducible impact

If you are unsure whether an issue qualifies as a security vulnerability, please report it privately.

After receiving a security report, the project maintainers will try to:

1. Acknowledge receipt of the report.
2. Triage and validate the vulnerability.
3. Determine affected versions and components.
4. Work on a fix or mitigation.
5. Coordinate disclosure when appropriate.
6. Publish a security notice or advisory if needed.

Response timelines may vary depending on the severity, complexity, and affected components.

Please keep the vulnerability confidential until the project maintainers have completed triage and coordinated a fix or mitigation.

Information shared with the security team will be handled carefully to reduce the risk of misuse or accidental disclosure.

Please do not publicly disclose a vulnerability before coordinated disclosure is completed.

Once a fix or mitigation is available, the project may publish a security notice, advisory, release note, or upgrade recommendation.

Security fixes may be delivered through:

• Patch releases
• Hotfixes
• Upgrade instructions
• Configuration mitigations
• Security advisories
• Documentation updates

Users are encouraged to keep ZSphere components up to date and follow published security guidance.

ZSvirt may include or depend on third-party open-source software.

Security vulnerabilities in third-party components may be handled by upgrading, patching, configuration changes, or other mitigations. Please include the affected third-party component and version in your report if known.

We appreciate responsible disclosure and may acknowledge reporters who help improve the security of ZSvirt, unless they prefer to remain anonymous.