Overview
Proper application design, intelligent programming, and secure infrastructure are all essential in creating a secure e-commerce store using any software (Spree included). The Spree team has done its best to provide you with the tools to create a secure and profitable web presence, but it is up to you to take these tools and put them in good practice. We highly recommend reading and understanding the Rails Security Guide.Supported Versions
The following versions are actively maintained and receive security patches.| Version | Release date | End of life |
|---|---|---|
| 5.0 | 26.03.2025 | 26.03.2028 |
| 4.10 | 06.09.2024 | 06.09.2027 |
Reporting Security Issues
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests. Instead, please send an email to security@spreecommerce.org. Please include as much of the following information as possible to help us triage your report:- Type of vulnerability (e.g. SQL injection, XSS, CSRF, etc.)
- Affected version(s)
- Step-by-step instructions to reproduce the issue
- Proof of concept or exploit code (if available)
- Impact assessment of the vulnerability
Submitting a Patch
If you would like to provide a patch yourself for the security issue do not open a pull request for it. Instead, create a commit on your fork of Spree and run this command:patch.txt file to security@spreecommerce.org.
Disclosure Process
- Security report is received and acknowledged within 48 hours.
- The issue is confirmed and a severity level is assigned.
- A fix is developed and tested against all supported versions.
- A new release is published with the fix and a GitHub Security Advisory is created.
- Reporter is credited in the advisory (unless anonymity is requested).
Security Advisories
Published security advisories can be found at GitHub Security Advisories.Security Best Practices
Spree is built on Ruby on Rails which provides strong security defaults including protection against SQL injection, CSRF, and XSS. For more details on how Spree handles security in production environments, see the Enterprise Security Overview. We recommend:- Keeping Spree and all dependencies up to date
- Following the Rails Security Guide
- Using bundler-audit to scan for known vulnerabilities in dependencies
- Running brakeman for static security analysis