26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# Security policy
|
|
|
|
## Reporting
|
|
|
|
Do not open a public issue for an unpatched vulnerability, leaked credential, unsafe
|
|
provider parser, privilege-boundary failure, or command-execution flaw. Until a private
|
|
security contact is configured for the eventual repository host, retain the report
|
|
locally and contact the project owner through an already established private channel.
|
|
|
|
No public security-response address is published during private development. A tested
|
|
private reporting route and disclosure policy are mandatory before public release.
|
|
|
|
## Supported versions
|
|
|
|
There are no public supported releases. The private main branch receives security fixes.
|
|
|
|
## Handling rules
|
|
|
|
- Never attach live provider tokens, personal library dumps, save files, or proprietary
|
|
launcher state to an issue or fixture.
|
|
- Provide the smallest sanitized reproducer that demonstrates the boundary failure.
|
|
- Record affected revision, platform, exact command, expected/observed behavior, and
|
|
whether exploitation requires local access, provider-controlled data, or privilege.
|
|
- Rotate any disclosed secret immediately; redaction after publication is not recovery.
|
|
|