Collectoh runs on people's own computers and servers, with their films, photos and families' accounts on it. If you've found a way to get at any of that, or at collectoh.com, we want to hear about it first, and quickly.
How to report one
Write to security@collectoh.com. Please don't post it on the forum, in a bug report, or anywhere else public before it's fixed.
Tell us:
- What's affected: the media server, with its version (Admin → Settings → Updates shows it), collectoh.com and Collectoh accounts, Collectoh Relay, or community.collectoh.com.
- How to see it happen, step by step.
- What someone could do with it.
- How to credit you, if you'd like to be.
What we do
- We say we've got your report within three working days.
- We keep you told as we work on it, and say when the fix is out.
- A fix to the media server comes in a numbered release. Every server learns of a new one within a day, and once it's out, its notes say what it fixed.
- We credit you in those notes if you'd like, and don't if you wouldn't.
While you look
Look as you'd want someone to look at yours. Test on a server and an account of your own, never someone else's. Don't read, keep or change other people's data, and don't slow down or break collectoh.com or anyone's server. Once you've found something, stop and write to us. Done that way, we won't act against you for it.
What's covered
- The Collectoh media server, its web app, and its Docker images,
collectoh/serverandcollectoh/postgres. - collectoh.com, Collectoh accounts, Collectoh Relay, and the catalogues that answer through collectoh.com.
- community.collectoh.com.
Plugins and extensions are their authors'. Tell the author, and us as well if it's one marked as reviewed by Collectoh.