Thank you for your interest in contributing to the security of this project,
If you believe you have found a security vulnerability, please follow these steps:
Do not publicly disclose the vulnerability. Public disclosure could put users at risk. Email a detailed report to [email protected]. Include a clear description of the vulnerability, affected versions, and steps to reproduce it. If possible, provide a proof-of-concept exploit or code snippet. Please do not attach any sensitive information or exploits to the email. What to expect after reporting:
You will receive an initial response within 72 hours acknowledging your report. The project team will promptly assess the severity of the vulnerability and determine a course of action. You will be kept informed of progress and any further actions required. Vulnerability acceptance:
If the vulnerability is accepted, the project team will work to promptly address it. You will be credited in the project's release notes for your contribution. Vulnerability decline:
If the vulnerability is not accepted, the project team will provide a detailed explanation of the reasoning. You are encouraged to discuss the issue further with the project team if you have any questions. Coordinated disclosure:
The project team will work with you to achieve a coordinated disclosure of the vulnerability, ensuring the safety of users and giving time for corrective measures. Public disclosure will only occur after a patch or mitigation is available. Additional considerations:
Please exercise responsible disclosure practices and avoid sharing vulnerability details publicly until a fix is available. If you are unsure about the impact of a potential vulnerability, please err on the side of caution and report it. The project team is committed to working with you to ensure the security of the project. Thank you for your cooperation!