Cupid NavazandGitHub
32ed120c57
Added a security policy document outlining supported versions and vulnerability reporting procedures.
52 lines
1.8 KiB
Markdown
52 lines
1.8 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Security updates are provided for actively maintained versions of this project.
|
|
|
|
| Version | Supported |
|
|
| ------- | --------- |
|
|
| Latest release | :white_check_mark: |
|
|
| Older releases | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in this project, please report it responsibly.
|
|
|
|
Please do not disclose security vulnerabilities publicly through GitHub Issues, Pull Requests, or other public channels before the maintainers have had an opportunity to investigate.
|
|
|
|
### How to Report
|
|
|
|
Please use GitHub's private vulnerability reporting feature for this repository if it is available.
|
|
|
|
If private vulnerability reporting is not available, contact the project maintainers through the repository's official GitHub channels and clearly identify the report as a security vulnerability.
|
|
|
|
Please include:
|
|
|
|
- A clear description of the vulnerability
|
|
- The affected component, file, or feature
|
|
- Steps to reproduce the issue
|
|
- The potential security impact
|
|
- Any proof-of-concept or relevant logs, if available
|
|
- A suggested mitigation or fix, if you have one
|
|
|
|
### What to Expect
|
|
|
|
After receiving a vulnerability report, maintainers should:
|
|
|
|
1. Acknowledge receipt of the report.
|
|
2. Investigate and validate the reported issue.
|
|
3. Determine the severity and affected versions.
|
|
4. Develop and test an appropriate fix.
|
|
5. Release or communicate the fix when appropriate.
|
|
|
|
Please allow reasonable time for investigation and remediation before publicly disclosing the vulnerability.
|
|
|
|
## Responsible Disclosure
|
|
|
|
We appreciate responsible security research and coordinated disclosure.
|
|
|
|
Security researchers are encouraged to avoid accessing, modifying, or deleting data belonging to others and to avoid actions that could disrupt services or users.
|
|
|
|
Thank you for helping improve the security of this project.
|