Security Report Follow-up — No Response After Nearly Three Weeks

3件の非公開 GitHub Security Advisory レポート（GHSA-qwr2-6pr4-pwfv、GHSA-7mj7-x75p-h627、GHSA-5vxc-fmq4-q3qh）と security@dify.ai とのやり取りから始めます。この issue は、Dify のメンテナーが受領を確認し、非公開の advisory スレッドを通じてレビュー状況を提示した時点で完了です。脆弱性の詳細を公開してはなりません。

Self Checks

• I have read the Contributing Guide and Language Policy.
• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report, otherwise it will be closed.
• 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
• Please do not modify this template :) and fill in all the required fields.

Dify version

<=1.17.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Hello Dify maintainers,

I am opening this issue solely to follow up on three private security vulnerability reports that I submitted through GitHub Security Advisories.

The reports are:

GHSA-qwr2-6pr4-pwfv
GHSA-7mj7-x75p-h627
GHSA-5vxc-fmq4-q3qh

It has now been nearly three weeks since the reports were submitted, and I have not received any response or acknowledgement in the private advisory threads.

✔️ Expected Behavior

I also sent an email to security@dify.ai approximately one week ago regarding these reports, but I have not received a response there either.

I am creating this public issue only to confirm that the reports have been received and to ask whether they are currently being reviewed.

For security reasons, I will not disclose any vulnerability details, PoCs, or other sensitive information in this public issue. All relevant technical details have already been provided through the private GitHub Security Advisory reports.

I am happy to provide any additional information or reproduction details through the private advisory threads.

Could a Dify maintainer please confirm receipt of these reports and advise whether they are under review?

Thank you.

❌ Actual Behavior

No response