Security
How we handle security for OpeNext CMS, how to report vulnerabilities responsibly, and what data this website collects.
Report a vulnerability
If you discover a security issue in OpeNext CMS, please do not open a public GitHub issue. Report it confidentially so we can investigate, fix, and publish an advisory before details are disclosed publicly.
info@aviraltrendzpvtltd.comFull policy on GitHub: SECURITY.md
Supported versions
| Version | Status |
|---|---|
| v0.1.x | Actively maintained |
| Earlier releases | No longer supported |
Responsible disclosure
- 1
Report the vulnerability privately via email — include steps to reproduce and potential impact.
- 2
Allow reasonable time for the core team to investigate and develop a fix.
- 3
Do not disclose the issue publicly until we have published a security advisory or fix.
- 4
We will acknowledge your report, keep you updated on progress, and credit researchers when appropriate.
Data handling
This page covers the OpeNext CMS marketing website (OpenNextCMS/openext.org). Self-hosted CMS deployments are under your control.
Newsletter signups
Email addresses submitted on the homepage are stored in Google Sheets and used to send a welcome email. We do not sell or share this data with third parties.
Contributor applications
Information submitted through the contribute form (name, email, GitHub username, and application details) is stored in Google Sheets for review by the core team.
Analytics
We use Google Tag Manager to understand site usage. You can control cookies through your browser settings.
Self-hosted CMS data
When you deploy OpeNext CMS yourself, all tenant and content data stays in your MongoDB instance. We do not have access to your self-hosted deployments.
For full details on website data collection, see our Privacy Policy.
Self-hosting best practices
- ✓Keep MongoDB credentials and API keys in environment variables — never commit them.
- ✓Use HTTPS in production and restrict dashboard access with strong authentication.
- ✓Assign the minimum RBAC role needed for each team member.
- ✓Keep dependencies updated and monitor the repository for security advisories.