Security Issues (Symfony Docs)

This document explains how Symfony security issues are handled by the Symfony core team (Symfony being the code hosted on the main symfony/symfony Git repository).
Found a security issue? Email security@symfony.com and don't disclose it publicly until a fix is released. Everything else on this page describes how the core team handles the report from there.
If you think that you have found a security issue in Symfony, don't use the bug tracker and don't publish it publicly. Instead, all security issues must be sent to security [at] symfony.com. Emails sent to this address are forwarded to the Symfony core team private mailing-list.
The following issues are not considered security issues and should be handled as regular bug fixes (if you have any doubts, don't hesitate to send us an email for confirmation):
In any case, the core team has the final decision on which issues are considered security vulnerabilities.
Symfony is an Open-Source project where most of the work is done by volunteers. We appreciate that developers are trying to find security issues in Symfony and report them responsibly, but we are currently unable to pay bug bounties.
For each report, we first try to confirm the vulnerability. When it is confirmed, the core team works on a solution following these steps:
Write a security announcement for the official Symfony blog about the vulnerability. This post should contain the following information:
Releases that include security issues should not be done on Saturday or Sunday, except if the vulnerability has been publicly posted.
While we are working on a patch, please do not reveal the issue publicly.
The resolution takes anywhere between a couple of days and a month depending on its complexity and the coordination with the downstream projects (see next paragraph).
As Symfony is used by many large Open-Source projects, we standardized the way the Symfony security team collaborates on security issues with downstream projects. The process works as follows:
The list of downstream projects participating in this process is kept as small as possible in order to better manage the flow of confidential information prior to disclosure. As such, projects are included at the sole discretion of the Symfony security team.
As of today, the following projects have validated this process and are part of the downstream projects included in this process:
The severity of each security issue is rated using its CVSS (Common Vulnerability Scoring System) score, calculated with the official CVSS calculator when requesting the CVE identifier. The resulting level (Low, Medium, High or Critical) determines the priority of the fix and how its release is coordinated.
You can check your Symfony application for known security vulnerabilities using the check:security command.
Check the Security Advisories blog category for a list of all security vulnerabilities that were fixed in Symfony releases, starting from Symfony 1.0.0.
Online exam, become Symfony certified today
Make sure your project is risk free
Thanks Cedric BERTOLINI (@alsciende) for being a Symfony contributor
4 commits • 29 lines changed
View all contributors that help us make Symfony
Be an active part of the community and contribute ideas, code and bug fixes. Both experts and newcomers are welcome.
Symfony™ is a trademark of Symfony SAS. All rights reserved.