43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
# Security Policy
|
|
|
|
Thank you for helping keep Zerobyte and its users secure.
|
|
|
|
Zerobyte is currently in `0.x`, and releases may include breaking changes between versions. For that reason, security fixes are only guaranteed for the most recent stable release line.
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| --------------------------------------------- | ------------------ |
|
|
| Latest stable `0.x` release | :white_check_mark: |
|
|
| Older stable `0.x` releases | :x: |
|
|
| Pre-release builds (`-alpha`, `-beta`, `-rc`) | :x: |
|
|
| Development snapshots from `main` | :x: |
|
|
|
|
Security fixes are generally released in the latest stable version only. If you are running an older release, you may be asked to upgrade before a fix is provided.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please do **not** report security vulnerabilities through public GitHub issues, discussions, or pull requests.
|
|
|
|
Use one of these private channels instead:
|
|
|
|
1. Preferred: GitHub private vulnerability reporting
|
|
https://github.com/nicotsx/zerobyte/security/advisories/new
|
|
2. Alternative: contact the maintainer directly by email if an address is listed in the repository or GitHub profile
|
|
|
|
When reporting, include as much of the following as you can:
|
|
|
|
- affected Zerobyte version
|
|
- deployment details, including whether you are using Docker, reverse proxies, or exposed ports
|
|
- clear reproduction steps or a proof of concept
|
|
- impact assessment and what an attacker could do
|
|
- any relevant logs, screenshots, or configuration excerpts with secrets removed
|
|
|
|
### What to expect
|
|
|
|
- We aim to acknowledge new reports within 7 days.
|
|
- We aim to provide status updates at least every 7 days while the report is being investigated.
|
|
- If the report is accepted, we will work on a fix, coordinate disclosure, and publish a security advisory when appropriate.
|
|
- If the report is declined, out of scope, or cannot be reproduced, we will explain why when possible.
|
|
|
|
Please avoid public disclosure until a fix has been released and maintainers have had reasonable time to notify users.
|