1.1 KiB
1.1 KiB
Security policy
Reporting
Do not open a public issue for an unpatched vulnerability, leaked credential, unsafe provider parser, privilege-boundary failure, or command-execution flaw. Until a private security contact is configured for the eventual repository host, retain the report locally and contact the project owner through an already established private channel.
No public security-response address is published during private development. A tested private reporting route and disclosure policy are mandatory before public release.
Supported versions
There are no public supported releases. The private main branch receives security fixes.
Handling rules
- Never attach live provider tokens, personal library dumps, save files, or proprietary launcher state to an issue or fixture.
- Provide the smallest sanitized reproducer that demonstrates the boundary failure.
- Record affected revision, platform, exact command, expected/observed behavior, and whether exploitation requires local access, provider-controlled data, or privilege.
- Rotate any disclosed secret immediately; redaction after publication is not recovery.