English | 中文

我们非常重视安全问题。如果你发现了安全漏洞，请按照以下流程报告。

我们只为最新的主要版本提供安全更新：

我们建议用户始终使用最新版本以获得最佳的安全保障。

请不要通过公开的 GitHub Issue 报告安全漏洞。公开披露可能会让恶意用户在修复发布前利用该漏洞。

请通过以下方式私密报告安全问题：

1. GitHub Security Advisories (推荐)

   • 访问相关仓库的 "Security" 标签页
   • 点击 "Report a vulnerability"

2. 电子邮件

   • 发送邮件至维护者（请在组织 Profile 中查找联系方式）
   • 邮件标题请注明 [SECURITY]

请在报告中包含以下信息：

• 漏洞类型 - 例如：XSS、信息泄露、权限提升等
• 受影响的版本 - 哪些版本受到影响
• 复现步骤 - 详细的复现步骤
• 影响范围 - 该漏洞可能造成的影响
• 可能的修复方案 - 如果你有建议的话

我们会尽快响应安全报告：

我们感谢所有负责任地报告安全问题的研究人员。在漏洞修复后（经你同意），我们会：

• 在发布说明中致谢
• 在安全通告中提及你的贡献

作为用户，你可以采取以下措施保护自己：

1. 保持更新 - 始终使用最新版本的插件
2. 来源可信 - 只从官方渠道安装插件
3. 定期备份 - 定期备份你的 Obsidian Vault
4. 审查权限 - 注意插件请求的权限

We take security issues seriously. If you discover a security vulnerability, please follow the process below to report it.

We only provide security updates for the latest major version:

We recommend users always use the latest version for optimal security.

Please do not report security vulnerabilities through public GitHub Issues. Public disclosure could allow malicious users to exploit the vulnerability before a fix is released.

Please report security issues privately through:

1. GitHub Security Advisories (Recommended)

   • Visit the "Security" tab of the relevant repository
   • Click "Report a vulnerability"

2. Email

   • Send an email to maintainers (find contact info in organization Profile)
   • Include [SECURITY] in the subject line

Please include the following information in your report:

• Vulnerability type - e.g., XSS, information disclosure, privilege escalation
• Affected versions - Which versions are affected
• Reproduction steps - Detailed steps to reproduce
• Impact scope - Potential impact of the vulnerability
• Possible fix - If you have suggestions

We will respond to security reports as quickly as possible:

We appreciate all researchers who responsibly report security issues. After the vulnerability is fixed (with your consent), we will:

• Credit you in release notes
• Mention your contribution in security advisories

As a user, you can take these measures to protect yourself:

1. Stay Updated - Always use the latest version of plugins
2. Trusted Sources - Only install plugins from official channels
3. Regular Backups - Regularly backup your Obsidian Vault
4. Review Permissions - Pay attention to permissions requested by plugins