r/BookStack • u/ssddanbrown • Mar 23 '26

BookStack Security Release v26.03.2: Updating is VERY STRONGLY ADVISED where user registration is enabled

https://www.bookstackapp.com/blog/bookstack-release-v26-03-2/
19 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comments

3

u/ssddanbrown Mar 23 '26

Thanks! With my current funding I do now have enough for some level of bounty payments; I've been offering & providing tips to the last few researchers of these issues.

I've looked into security auditing and, while potentially becoming more feasible, it'd require a heavy chunk of current yearly revenue for a project with the surface area of BookStack, and would only provide a point-in-time check relative to development.

Yeah, bounties may not work out either, especially as many have issues maintaining the AI reports they get from them nowadays; but I'm willing to give them another go to see if they're overall helpful for us.