We take security bugs in Cinemoon seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
To report a security issue, email simon@koeck.dev and include the word "SECURITY" in the subject line.
We'll send a response indicating the next steps in handling your report. After the initial reply to your report, we'll endeavor to keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.
When the security team receives a security bug report, they will assign it to a primary handler. This person will coordinate the fix and release process. The process can involve the following steps:
- Confirming the problem and determining the affected versions.
- Auditing code to find any potential similar problems.
- Preparing fixes for all releases still under maintenance.
If you have suggestions on how this process could be improved, please submit a pull request.