Skip to content

Latest commit

 

History

History
38 lines (26 loc) · 1.41 KB

SECURITY.md

File metadata and controls

38 lines (26 loc) · 1.41 KB

Security Policies and Procedures

This document outlines security procedures and general policies for Chafa.

Reporting a Bug

We are grateful for the testing and analysis carried out by the community. All bug reports are taken seriously.

Normally, bugs can be filed directly in the public GitHub issue tracker, but if you believe there is a security impact, please contact the lead maintainer at his e-mail address hpj@hpjansson.org instead.

We will most likely respond within 48 hours, but since Chafa is a volunteer project, please allow up to a week for those rare times we're away from the keyboard or general connectivity.

When a fix is published, you will receive credit under your real name or bug tracker handle in the NEWS document and possibly elsewhere (GitHub, blog post, etc). If you prefer to remain anonymous or pseudonymous, you should mention this in your e-mail.

Disclosure Policy

The maintainer will coordinate the fix and release process, involving the following steps:

  • Confirm the problem and determine the affected versions.
  • Audit code to find any potential similar problems.
  • Prepare fixes for all releases still under maintenance. These fixes will be released as fast as possible.

You may be asked to provide further information in pursuit of a fix.

Comments on this Policy

If you have suggestions on how this process could be improved, please submit an issue or pull request.