weblate/security.yaml

header:
  schema-version: 2.0.0
  last-updated: '2026-06-15'
  last-reviewed: '2026-06-15'
  url: https://github.com/WeblateOrg/weblate
  comment: >-
    This file contains all possible information for both project and repository,
    though it is not required to include all of this information every time. Nor
    is it required to include both a project and repository section if the
    project section is intended to be inherited by repositories via
    header.project-si-source
project:
  name: Weblate
  homepage: https://weblate.org/
  funding: https://weblate.org/donate/
  roadmap: https://github.com/WeblateOrg/weblate/milestones
  steward:
    uri: https://weblate.org/
    comment: Weblate s.r.o. is the legal entity providing support for Weblate.
  administrators:
  - name: Michal Čihař
    affiliation: Weblate s.r.o.
    email: michal@weblate.org
    social: https://github.com/nijel
    primary: true
  documentation:
    quickstart-guide: https://docs.weblate.org/en/latest/admin/install.html
    detailed-guide: https://docs.weblate.org/
    code-of-conduct: https://docs.weblate.org/en/latest/contributing/code_of_conduct.html
    release-process: https://docs.weblate.org/en/latest/contributing/release.html
    support-policy: https://docs.weblate.org/en/latest/admin/support.html
    signature-verification: https://docs.weblate.org/en/latest/security/release-artifacts.html#verifying-release-artifacts
  repositories:
  - name: Weblate
    url: https://github.com/WeblateOrg/weblate
    comment: Weblate source code
  vulnerability-reporting:
    reports-accepted: true
    bug-bounty-available: false
    contact:
      name: Weblate Security
      email: security@weblate.org
      primary: true
    security-policy: https://docs.weblate.org/en/latest/security/issues.html
    in-scope:
    - Weblate source code in https://github.com/WeblateOrg/weblate
    - Weblate release artifacts published by this repository
    - Weblate security properties documented in the threat model
    out-of-scope:
    - Third-party components as independent projects
    - Third-party add-ons unless Weblate permission or installation boundaries are bypassed
    - Malicious local operators with unrestricted deployment access
    - Downstream applications rendering translated content outside Weblate
    pgp-key: 8EA7 6E43 0976 3323 C2E3 D5A0 C472 9F23 8A80 EA93
repository:
  url: https://github.com/WeblateOrg/weblate
  status: active
  bug-fixes-only: false
  accepts-change-request: true
  accepts-automated-change-request: true
  no-third-party-packages: false
  core-team:
  - name: Michal Čihař
    affiliation: Weblate s.r.o.
    email: michal@weblate.org
    social: https://github.com/nijel
    primary: true
  - name: ' Benjamin Alan Jamie '
    affiliation: Weblate s.r.o.
    email: benjamin@weblate.org
    social: https://github.com/orangesunny
    primary: false
  documentation:
    contributing-guide: https://docs.weblate.org/en/latest/contributing/index.html
    review-policy: https://docs.weblate.org/en/latest/contributing/code.html
    security-policy: https://docs.weblate.org/en/latest/security/index.html
    governance: https://docs.weblate.org/en/latest/security/governance.html
    dependency-management-policy: https://docs.weblate.org/en/latest/security/dependencies.html
  release:
    changelog: https://docs.weblate.org/en/latest/changes.html
    automated-pipeline: true
    attestations:
    - name: Weblate package build provenance
      predicate-uri: https://slsa.dev/provenance/v1
      location: https://github.com/WeblateOrg/weblate/actions/workflows/setup.yml
      comment: >-
        Generated by the Weblate distribution workflow using GitHub artifact
        attestations for release package archives.
    - name: Weblate package SBOM attestation
      predicate-uri: https://cyclonedx.org/bom
      location: https://github.com/WeblateOrg/weblate/actions/workflows/setup.yml
      comment: >-
        Generated by the Weblate distribution workflow using the CycloneDX
        release SBOM as an SBOM attestation for release package archives.
    distribution-points:
    - uri: https://github.com/WeblateOrg/weblate/releases
      comment: GitHub releases
    - uri: https://pypi.org/project/weblate/
      comment: Python Package Index
    - uri: https://hub.docker.com/r/weblate/weblate/
      comment: Docker container images
    - uri: https://github.com/WeblateOrg/docker/pkgs/container/weblate
      comment: Docker container images
    license:
      url: https://docs.weblate.org/en/latest/contributing/license.html
      expression: GPL-3.0
  security:
    champions:
    - name: Michal Čihař
      email: michal@weblate.org
      primary: true
    tools:
    - name: GitHub CodeQL
      type: SAST
      rulesets:
      - default
      results:
        ci:
          name: GitHub code scanning
          location: https://github.com/WeblateOrg/weblate/security/code-scanning?query=tool%3ACodeQL
          comment: CodeQL is listed in the test documentation; code scanning configuration is managed by GitHub.
      integration:
        adhoc: false
        ci: true
        release: false
    - name: GitHub dependency review
      type: SCA
      rulesets:
      - default
      results:
        ci:
          name: Dependency review workflow
          location: https://github.com/WeblateOrg/weblate/actions/workflows/dependency-review.yml
          comment: Runs on pull requests.
      integration:
        adhoc: false
        ci: true
        release: false
    - name: FOSSA
      type: SCA
      rulesets:
      - default
      results:
        ci:
          name: FOSSA workflow
          location: https://github.com/WeblateOrg/weblate/actions/workflows/fossa.yml
          comment: Runs scan and test jobs on main pushes; detailed results are in FOSSA.
      integration:
        adhoc: false
        ci: true
        release: false
    - name: OpenSSF Scorecard
      type: Supply-chain security
      rulesets:
      - default
      results:
        ci:
          name: Scorecard workflow
          location: https://github.com/WeblateOrg/weblate/actions/workflows/scorecards.yml
          comment: Runs scheduled and main-branch supply-chain security analysis.
      integration:
        adhoc: false
        ci: true
        release: false