Skip to content

Repository navigation

SECURITY.md

Latest commit

 

History

History
79 lines (49 loc) · 3.31 KB

SECURITY.md

File metadata and controls

79 lines (49 loc) · 3.31 KB
Raw

Security Policy

Thanks for helping keep this project and its users safe.

Supported Versions

We provide security updates only for the latest stable release of this project.

As the project matures, we may adopt a more formal support policy (for example, supporting multiple release lines or LTS branches). Until then, please upgrade to the latest stable release to receive security fixes.

Version Supported
Latest stable release ✅
Older releases ❌

Security fixes land on develop and ship through the protected production release branch. Release support remains limited to the latest stable release.

Anthropic OSS Scanner contact

The maintainer-designated primary security contact for Core's Anthropic OSS Scanner enrollment is blake@globalfellowship.org. This address is approved for public listing and receipt of program build notifications and findings. It does not change the private reporting route or commitments below. Maintainers operate the setup and triage reports using the OSS Scanner runbook.

Reporting a Vulnerability

Where to report

Please report security issues privately using GitHub Security Advisories / Private Vulnerability Reporting:

  • Go to this repository → Security tab → Advisories → Report a vulnerability

Please do not open a public GitHub issue for security vulnerabilities.

What to include

To help us triage quickly, include:

  • A clear description of the issue and potential impact
  • Steps to reproduce (proof-of-concept if available)
  • Affected versions / environments
  • Any relevant logs, screenshots, or stack traces
  • Whether you believe the issue is exploitable and how

What to expect from us

We aim to:

  • Acknowledge your report within 72 hours
  • Provide a status update at least every 7 days while investigating
  • Work toward a fix and release. Typical target is 30 days, but severe issues may be faster and complex issues may take longer.

If we determine the report is not a security issue or is not reproducible, we’ll explain our reasoning.

Scope (what we accept)

We accept reports for:

  • Vulnerabilities in this project’s code, configuration, build, or release artifacts
  • Supply-chain issues that affect this project (e.g., a vulnerable dependency that is reachable/exploitable through normal usage)

If an issue exists only in an upstream dependency, we may ask you to also report it to the upstream maintainers (and we’ll track mitigation/updates on our side as needed).

Coordinated disclosure

We support responsible disclosure. If you plan to disclose publicly, please allow us up to 60 days to investigate and release a fix, unless there is active exploitation or other urgent risk.

Safe harbor

We welcome good-faith security research and coordinated disclosure. We will not pursue legal action against researchers who:

  • Make a good-faith effort to avoid privacy violations, data destruction, and service disruption
  • Only test against systems/accounts they own or have explicit permission to test
  • Stop testing and report promptly if they encounter sensitive data

This safe-harbor guidance does not authorize accessing data that is not yours or engaging in activity that is unlawful.