TrueNAS Vulnerability Disclosure Policy
TrueNAS (iXsystems, Inc. DBA TrueNAS) welcomes reports of security vulnerabilities in our products. This page explains what to report, how to report it, and what to expect. It governs our vulnerability handling and CVE assignment process.
Report privately through the TrueNAS Security Disclosure service desk, or by email:
- Service desk: create a Jira account and open a new TrueNAS Security Disclosure . Tickets are confidential between the reporter and the TrueNAS Security team.
- Email: psirt@truenas.com
- Encryption: our PGP key is published on this site; use it to encrypt sensitive details.
Please include enough to reproduce and assess the issue: affected product and version, a description of the vulnerability, reproduction steps or a proof of concept, and the impact you observed. If you have a suggested remediation, we welcome it.
Report privately. Please do not open public GitHub issues or pull requests for security issues, and please give us a chance to remediate before any public disclosure.
In scope — vulnerabilities in TrueNAS-developed and TrueNAS-maintained products:
- TrueNAS (Community Edition and Enterprise), all supported releases, including BETA and RC builds offered for testing — including the middleware (
middlewared) and the TrueNAS API, which ship as part of the product. - TrueNAS CORE, for releases still under support.
- TrueNAS-authored changes to bundled open-source components — including the TrueNAS downstream Linux kernel and OpenZFS changes as shipped in TrueNAS.
- First-party TrueNAS tools and integrations, such as the TrueNAS Proxmox plugin and the installer.
Out of scope:
- Vulnerabilities in unmodified upstream components (for example the mainline Linux kernel, Samba, OpenSSL, or Debian packages) where the defect is not introduced by a TrueNAS change — report these to the relevant upstream project.
- Third-party applications distributed through the TrueNAS app catalog but developed by others.
- End-of-life products past their supported lifetime.
- Findings that depend on operational misconfiguration rather than a product defect.
- Reports that are purely theoretical with no demonstrable security impact, volumetric denial-of-service, and best-practice or scanner-output observations without an exploitable condition.
- Acknowledgement within 3 business days.
- Triage and a determination — we confirm whether the report is a vulnerability in scope and communicate the outcome. If we conclude it is not a vulnerability, we explain why.
- A CVE — for confirmed, in-scope vulnerabilities, TrueNAS obtains a CVE ID and publishes a CVE record when the fix becomes available.
- Coordinated disclosure — we prepare a fix and a security advisory before public disclosure. Our default coordination window is up to 90 days from a confirmed report, adjustable by mutual agreement and shortened if a vulnerability is being actively exploited.
- Credit — we credit reporters in the advisory and the CVE record unless you ask us not to.
If we classify a report as not a vulnerability and you disagree, tell us — we will revisit it. For a CVE-specific dispute you may also escalate through the CVE Program Root CNA.
TrueNAS does not currently operate a paid bug-bounty program. Reports are handled under coordinated disclosure with credit as described above.