Skip to content

SECURITY.md

Latest commit

 

History

History
35 lines (22 loc) · 1.3 KB

SECURITY.md

File metadata and controls

35 lines (22 loc) · 1.3 KB

Security Policy

Supported versions

Compendium is pre-1.0. Only the latest released preview / stable line receives security fixes.

Version Supported
1.x ✅
< 1.0 ❌

Reporting a vulnerability

Please do not open public issues for security vulnerabilities.

Report privately via GitHub Security Advisories. GitHub will notify the maintainers, and the advisory gives us a private channel to coordinate a fix before public disclosure.

When reporting, please include:

  1. The affected package(s) and version(s).
  2. A description of the vulnerability and its impact.
  3. Steps to reproduce, ideally a minimal repro repository or code snippet.
  4. Whether you'd like to be credited in the advisory once published.

Response expectations

  • Acknowledgement within 5 working days.
  • Triaged severity within 10 working days.
  • Fix timeline communicated as soon as the issue is validated.

We cannot guarantee a specific fix SLA for this pre-1.0 phase, but we take reports seriously and will keep you updated.

Disclosure

Once a fix is released, the advisory is published with a CVE (if applicable), affected version range, patched version, and a credit to the reporter if consented.