Fusio Vulnerability Disclosure

generated: '2026-08-29'
method: probed
source: https://demo.fusio-project.org/.well-known/security.txt
provider: Fusio
providerId: fusio
program: security-txt
published: true
description: >-
  Fusio ships an RFC 9116 security.txt as part of the product, so every Fusio deployment serves a
  disclosure contact by default. It is served from the project's own reference instance and names
  the maintainer's security address directly.
security_txt:
  url: https://demo.fusio-project.org/.well-known/security.txt
  status: 200
  file: well-known/fusio-security.txt
  standard: RFC 9116
  contacts:
    - mailto:security@fusio-project.org
    - https://github.com/apioo/fusio
    - https://chrisk.app/
  expires: '2026-09-29T00:00:00.000Z'
  encryption: https://chrisk.app/pub.key
  preferred_languages: en
  policy: null
  acknowledgments: null
bug_bounty:
  program: none
  note: No HackerOne, Bugcrowd or Intigriti program was found.
disclosure_policy_page:
  published: false
  note: >-
    No SECURITY.md in the fusio repository (https://github.com/apioo/fusio/blob/master/SECURITY.md
    returns 404) and no written disclosure policy page. The security.txt carries a Contact and an
    Encryption key but no Policy line, so a reporter is told WHO to contact but not what to expect
    back.
advisories:
  channel: >-
    Security fixes are announced in the changelog by advisory id, e.g. 7.1.1 "Update mcp/sdk to fix
    PKSA-p9gd-j6gr-6f9t".
  url: https://github.com/apioo/fusio/blob/master/CHANGELOG.md
gaps:
  - No Policy line in security.txt.
  - No SECURITY.md in the primary repository.
  - >-
    The security.txt Expires value is 2026-09-29, one month out from this probe; RFC 9116 requires
    consumers to treat an expired file as invalid, so it needs refreshing on a short cycle.
  - >-
    The website host www.fusio-project.org serves no security.txt at all; only Fusio DEPLOYMENTS
    do. A reporter who goes to the project's website first will not find it.
evidence:
  - url: https://demo.fusio-project.org/.well-known/security.txt
    status: 200
  - url: https://www.fusio-project.org/.well-known/security.txt
    status: 404
  - url: https://github.com/apioo/fusio/blob/master/SECURITY.md
    status: 404
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com