39 lines
1.5 KiB
Markdown
39 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Security fixes are applied to the latest commit on the `main` branch. This
|
|
repository does not currently publish versioned releases, so older commits and
|
|
forks are not maintained as separate security-support channels.
|
|
|
|
## Report a vulnerability privately
|
|
|
|
Please use [GitHub private vulnerability reporting](https://github.com/cathrynlavery/diagram-design/security/advisories/new).
|
|
Do not disclose a suspected vulnerability in a public issue, pull request,
|
|
discussion, or social-media post before we have coordinated disclosure.
|
|
|
|
Include as much of the following as you can:
|
|
|
|
- the affected file, script, or workflow;
|
|
- a description of the impact and who could be affected;
|
|
- clear reproduction steps or a minimal proof of concept;
|
|
- any conditions required to exploit the issue;
|
|
- a suggested mitigation, if you have one.
|
|
|
|
Avoid including secrets, credentials, or personal data in the report.
|
|
|
|
## What to expect
|
|
|
|
We will acknowledge the report as soon as practical, validate the finding,
|
|
determine its scope, and coordinate remediation and disclosure with the
|
|
reporter. Please allow time for a fix to be developed and tested before public
|
|
disclosure.
|
|
|
|
## Good-faith research
|
|
|
|
Please avoid accessing, modifying, or deleting data that does not belong to
|
|
you, disrupting services, or degrading other users' experience. If testing
|
|
could affect other people or systems, stop and submit a private report first.
|
|
|
|
Thank you for helping keep Diagram Design and its users safe.
|