Skip to content

Security: nattadasu/ryuuRyuusei

SECURITY.md

Ryuuzaki Ryuusei Security Notice

Greetings! I'm Sultan Iskandar Maulana, also known as Natsu Tadama, the creator of Ryuuzaki Ryuusei Discord Bot. Thank you for your interest in contributing to this project. Before you proceed, please carefully review the information outlined in this notice.

Supported Versions

Ryuuzaki Ryuusei follows a versioning system loosely based on interactions.py versioning, which draws inspiration from Semantic Versioning. However, Ryuuzaki Ryuusei does not strictly adhere to Semantic Versioning, as it is a rolling release software.

To provide clarity, here is a table of the currently supported versions, based on interactions.py versioning, where name on bracket is the name of the release branch:

Interactions.py Version Support Status Notes
5.8.0 Current release version
5.7.0
5.6.0
5.5.1
5.5.0 Pin discord_typings to 0.5.1 if you use this version
< 5.4.0 Deprecated due to Discord image proxy bug, see discord/discord-api-docs#6171
< 4.4.0 Unsupported, bot requires Python 3.10 or higher

Reporting a Vulnerability

If you have identified any vulnerabilities in Ryuuzaki Ryuusei, we highly encourage you to report them promptly. This will help us maintain the security and integrity of the project. You can report vulnerabilities through the following channels:

1. GitHub Issues

Please visit the Issues section of the project's GitHub repository. Before submitting a new issue, ensure that the vulnerability you are reporting is not a duplicate of an existing issue. Feel free to provide as much detail as possible, including steps to reproduce the vulnerability and any relevant context.

2. Email

If you are not comfortable using GitHub or prefer to communicate privately, you can contact me directly via email at hello@nattadasu.my.id or nattadasu@proton.me. When reporting a vulnerability via email, please use the subject line "Ryuuzaki Ryuusei Vulnerability Report" to help us prioritize and address the issue promptly. Include a clear and concise description of the vulnerability, along with any supporting evidence or details that can assist in understanding and resolving the issue.

Note that if you sent an email to @nattadasu.my.id domain, we might reply to you using @proton.me domain instead. This is due to us unable to send email from @nattadasu.my.id domain, but we can receive email just fine (read-only).

3. Discord

You can also report vulnerabilities via Discord by contacting us directly at our support server. Please use the subject line "Ryuuzaki Ryuusei Vulnerability Report" to help us prioritize and address the issue promptly on "#ryuuzaki-ryuusei-bot" forum channel. Before submitting a new thread, ensure that the vulnerability you are reporting is not a duplicate of an existing thread.

Responsible Disclosure

We appreciate your commitment to responsible disclosure. To ensure the security of our users and the stability of the project, we kindly request that you adhere to the following guidelines when reporting vulnerabilities:

  • Provide detailed information about the vulnerability, including steps to reproduce and any necessary technical details.
  • Avoid public disclosure of the vulnerability before it has been addressed and mitigated.
  • Allow a reasonable amount of time for us to investigate and resolve the reported vulnerability before disclosing it to others.
  • Respect user privacy and data protection laws when handling any sensitive information obtained during the vulnerability assessment.

We are committed to addressing reported vulnerabilities promptly and maintaining transparent communication throughout the resolution process.

Please note that the acceptance or declination of a reported vulnerability will depend on various factors, including its impact, severity, and feasibility of a fix. If the vulnerability is accepted, we will work towards addressing and resolving it. If it is declined, we will provide a clear explanation of the reasons for the decision.

Thank you for your cooperation in making Ryuuzaki Ryuusei a more secure and reliable project. Your contributions are highly valued!

There aren’t any published security advisories