Trove is maintained by one person, so only the latest release gets security fixes. Fixes land on develop first and reach a release when develop is promoted to master.

To update a native install, run ./deploy.sh in /opt/trove or use Update now in the app. For Docker, pull the latest image.

Every push to develop, every pull request from this repository and every release is scanned with TrendAI's code security scanner (TMAS):

• the source code, for vulnerable dependencies and committed secrets;
• the published container image, both amd64 and arm64, for vulnerabilities, malware and secrets.

Any issues found are addressed: fixed, usually by updating the affected dependency, or, for a false positive, reviewed and recorded in .github/tmas-overrides.yml with the reason.

Please don't open a public issue for a security problem.

Report it privately through GitHub instead: Report a vulnerability (the Security tab, then "Report a vulnerability"). Only the maintainer can see it.

Helpful things to include:

• what an attacker can do, and what they need first (an account, a particular permission, a Kobo or OPDS token, network access);
• the steps or a request that shows it;
• the Trove version (shown in the app's sidebar) and whether you run it natively or in Docker.

• You'll get a reply within 7 days.
• If it's confirmed, the fix is worked on privately and released as soon as it's ready; you'll be told when, and credited in the advisory unless you'd rather not be.
• If it isn't treated as a vulnerability, you'll be told why.

In scope: the Trove server and web app in this repository, including its Kobo, KOReader, OPDS and Komga-compatible APIs, and the install, deploy and update scripts.

Out of scope: problems that need an administrator account to exploit against the same install, a setup that ignores the install notes (for example, exposing the database to the internet), and issues in BookLore or Grimmory that don't affect Trove (report those to those projects).