This document is the private channel for reporting vulnerabilities in Telixon.
Use the GitHub Security Advisory form:
github.com/martsinlabs/telixon/security/advisories/new.
Alternatively, email support@telixon.dev. The Advisory form is preferred because it keeps the
report trackable inside GitHub.
Do not file a public issue. Do not post details on social media or blogs before a fix is released.
In scope:
- Vulnerabilities in
@telixon/coreengine logic (parsing, validation, formatting) - Vulnerabilities in
@telixon/web-sdkinput handling - ReDoS or CPU exhaustion via crafted phone-number input
- Prototype pollution via the public API
- Supply-chain attacks on published
@telixon/*artifacts
Out of scope:
- Vulnerabilities in third-party dependencies. Report those to the dependency upstream.
- Issues in downstream applications that use Telixon. Those are the application's responsibility.
- Theoretical attacks without a reproducible proof of concept.
- Denial of service via legitimate but expensive input.
| Version | Supported |
|---|---|
| 1.x | Yes |
Security fixes land in the latest 1.x release.
- Acknowledgment: within 5 business days of report receipt.
- Initial assessment and triage: within 14 days.
- Fix and coordinated disclosure: case-by-case, embargo typically 30 to 90 days.
- You submit a private report through the GitHub Security Advisory form.
- The maintainer acknowledges within 5 business days.
- You and the maintainer agree on the impact assessment and embargo timeline.
- A patch is prepared and released in a new version.
- A public advisory is published, with a CVE identifier if appropriate and credit to the reporter.
Reporters who follow this policy in good faith are credited by name in the public advisory, unless they prefer to remain anonymous.
Telixon will not pursue legal action against or report researchers who:
- act in good faith,
- limit testing to their own copy or a controlled environment,
- avoid impacting other users of Telixon-based applications,
- privately disclose findings through this channel before any public disclosure,
- allow reasonable time for a fix before disclosing.
This policy follows the principles of disclose.io.