Skip to content

SECURITY.md

Latest commit

 

History

History
30 lines (19 loc) · 1.29 KB

SECURITY.md

File metadata and controls

30 lines (19 loc) · 1.29 KB
Raw

Security policy

Supported versions

Version Supported
3.x Yes
2.x and earlier No

Security fixes are released as patch versions of the supported line.

Reporting a vulnerability

Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or Discord.

Report them privately through GitHub instead:

  1. Open the Security tab of this repository.
  2. Select Report a vulnerability.
  3. Describe the issue, the affected versions and packages, and the steps to reproduce it. A proof of concept helps us confirm it faster.

GitHub's guide to privately reporting a security vulnerability explains the form.

What to expect

  • We aim to acknowledge new reports promptly and keep you updated in the private advisory.
  • We confirm or reject the report and share our assessment there.
  • Once a fix is available, we publish the advisory with the fixed versions and credit the reporter unless they ask us not to.

Please give us a reasonable amount of time to release a fix before you disclose the issue publicly.