Decap CMS takes security seriously. This document outlines our security policy, supported versions, and how to report security vulnerabilities.
Security updates are provided for:
| Version | Status | Lifecycle |
|---|---|---|
| 3.x | ✅ Actively Supported | Current stable release |
| 2.x (Netlify CMS) | ❌ Unsupported | Legacy - no updates |
| 1.x (Netlify CMS) | ❌ Unsupported | Legacy - no updates |
Note: Decap CMS was renamed from Netlify CMS in February 2023. Versions 1.x and 2.x are no longer maintained. We recommend upgrading to version 3.x for security updates and new features.
If you discover a security vulnerability in Decap CMS, please report it confidentially through GitHub Security Advisories. This allows us to investigate and address the issue without exposing it to the public until a fix is ready.
Submit your report at: https://github.com/decaporg/decap-cms/security/advisories/new
- Do not open a public GitHub issue for the vulnerability
- Do not post details on social media or public forums
- Do not attempt to exploit the vulnerability beyond confirming it exists
- Do not access data beyond what's necessary to demonstrate the issue
This project follows a 90-day disclosure timeline.
- Dependabot alerts and automated security-fix PRs are not currently enabled on this repository; dependency vulnerabilities are tracked and patched manually
- Code changes are gated by a local pre-push hook (
.husky/pre-push) that runs linting, type-checking, and unit tests; the "Node CI" GitHub Actions workflow itself is manual-dispatch-only (workflow_dispatch) and does not run automatically on push or pull request, for cost reasons - There is no automated end-to-end test run; end-to-end tests exist but must be run manually
- All pull requests require code review before merging
- Passwords are not stored by Decap CMS; authentication is delegated to providers
- This is a community-maintained open-source project, not a commercial product with dedicated security resources
- Security depends on the stability and practices of underlying dependencies and backend providers
- Some vulnerabilities in dependencies may not be immediately patchable if they break backwards compatibility
- This is a project with a long history, and many legacy dependencies can't be updated without significant refactoring