Security

Found a way to break DevStream, or to bend its rankings? Please tell me privately first. A public issue hands the trick to everyone before I can close it.

The full policy is SECURITY.md. This page is the short version.

How to report

1. Open the Security tab of the repo.
2. Select Report a vulnerability.
3. Tell me what you found, how to reproduce it, and what an attacker could do with it.

Only you and I can see the report. There's no email address to hunt for.

What to expect

When	What
Within 48 hours	I acknowledge your report.
Within 7 days	My first assessment: whether I can reproduce it, how serious it is, and what I plan to do.
Within 90 days	Coordinated disclosure, agreed with you.

I'll credit you in the advisory if you'd like. I fix security problems on main and in the latest release.

What's in scope

• The bot and its workflows. Anything that lets someone run code, read secrets, write to the repo, or push the bot into a decision it shouldn't make.
• The site. Script injection, broken escaping of entry data, anything that turns the leaderboard against the people reading it.
• Data integrity. Getting an entry listed past the Quality Bar, keeping one alive that should be removed, or removing someone else's.
• Likes gaming. A way to inflate Likes that slips past the trust rule and burst checks counts, even when no code misbehaves.

What isn't

• Holes in a listed repo. Report those to that project through its own security policy. If a listed repo is malicious, report the entry and pick "Malicious".
• Flooding the issue tracker, and anything that needs a compromised maintainer account.

Safe harbour

Research in good faith is welcome. Test against your own accounts and test repos, stop once you've shown the problem, and give me the time above before going public. Do that, and I won't pursue legal action. Not sure whether something's covered? Ask in the advisory first.