SECURITY.md 1.9 KB
Security Policy
Supported Versions
Security fixes are provided for the latest released minor version. Older versions are not maintained; please upgrade before reporting.
| Version | Supported |
|---|---|
| 0.7.x | ✅ |
| < 0.7 | ❌ |
Reporting a Vulnerability
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Report vulnerabilities privately through GitHub's built-in private vulnerability reporting:
- Go to the repository's Security tab.
- Select Report a vulnerability.
- Provide a clear description, affected versions, reproduction steps, and potential impact.
This opens a private advisory visible only to the maintainers and to you.
What to include
- The affected component and version.
- Steps to reproduce, or a proof of concept.
- The impact you believe the issue has.
What not to include
- Do not include real secrets, credentials, API keys, or access tokens in your report. If a secret has been exposed, say so and rotate it — do not paste its value.
Response Expectations
This project is maintained on a best-effort basis. Reports are reviewed and addressed as maintainer availability allows; there is no guaranteed response time. We will engage with the private advisory as we triage and work on a fix.
Coordinated Disclosure
We follow coordinated disclosure. Please give the maintainers a reasonable opportunity to investigate and release a fix before disclosing the issue publicly. We will coordinate the timing and content of any public disclosure with you through the private advisory.
Scope
This policy covers the code in this repository. Vulnerabilities in third-party dependencies should be reported to the respective upstream projects; if a dependency issue affects this project specifically, you may still report it here so we can track remediation.