| Version | Supported |
|---|---|
latest main |
✅ |
| latest 2 tags | ✅ |
| older | ❌ |
Please do not open a public issue for security problems.
Use GitHub's private vulnerability-reporting flow:
https://github.com/your-org/myproject/security/advisories/new
Alternative channel: email security@example.com — PGP-encrypt anything
sensitive; request the public key via the same address.
Please include:
- Affected version(s) / commit SHA.
- A minimal reproducer (inputs, command line, expected vs. actual).
- Your assessment of impact (crash / memory corruption / DoS / info leak).
- Whether you believe a CVE should be requested.
- Acknowledgment: within 72 hours.
- Initial triage: within 7 days.
- Fix + coordinated disclosure: severity-dependent; we aim for 90 days max.
Releases ship with SLSA L3 provenance, Sigstore keyless (cosign) signatures, and
both SPDX + CycloneDX SBOMs (see .github/workflows/supply-chain.yml). Verify a
release artifact:
cosign verify-blob --bundle <artifact>.bundle <artifact>This project targets the controls scaffolded for OWASP ASVS L2, NIST SSDF, and
SLSA L3. Downstream products assert their compliance posture in their own
SECURITY.md.