Continuum believes that strong security is a blend of highly technical security researchers who care about security and the forward progression of the ecosystem and the attentiveness and openness of Continuum core contributors to help continually secure our operations.

IMPORTANT: DO NOT open public issues on this repository for security vulnerabilities.

The latest release tag of this repository is supported for security updates as well as the main branch. Security vulnerabilities should be reported if the vulnerability can be reproduced on either one of those.

Issues identified in this repository may be eligible for a bug bounty.

Please send your report via email to security@c8ntinuum.com with reproduction steps and details of the issue.

We require that all researchers:

• Abide by this policy to disclose vulnerabilities, and avoid posting vulnerability information in public places, including GitHub, Discord, Telegram, and Twitter.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data.
• Keep any information about vulnerabilities that you’ve discovered confidential between yourself and the c8ntinuum engineering team until the issue has been resolved and disclosed.
• Avoid posting personally identifiable information, privately or publicly.

If you follow these guidelines when reporting an issue to us, we commit to:

• Not pursue or support any legal action related to your research on this vulnerability
• Work with you to understand, resolve and ultimately disclose the issue in a timely fashion