THIS IS A BLANKET SECURITY POLICY ACROSS ALL MY REPOSITORIES
All software provided in my repositories is distributed "as-is" without any warranty. You use this software at your own risk. I am not liable for any damages, data loss, or other issues that may arise from using this software, including those caused by unpatched vulnerabilities.
That said, I take security seriously and appreciate responsible disclosure of vulnerabilities. Please see the sections below for supported versions and how to report security issues.
As a hobbyist developer, I do not have dedicated resources for continuous vulnerability monitoring. However, I commit to the following:
- Latest Release: When a vulnerability is reported or discovered, I will prioritize releasing an updated version with patched dependencies as soon as reasonably possible.
- Older Releases: Previous releases are not actively maintained or backported with security fixes. Users are strongly encouraged to always use the latest stable release.
If you discover a security vulnerability, please report it responsibly:
- Do NOT open a public issue – This could expose the vulnerability to malicious actors before it's fixed.
- Use GitHub Security Advisories: Navigate to the specific repository and click on the "Security" tab, then select "Report a vulnerability." This ensures private communication.
- Provide Details: Include as much information as possible:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if applicable)
I will acknowledge receipt of your report when able and provide updates as the issue is investigated and resolved. Once a fix is released, I will credit you in the release notes (unless you prefer to remain anonymous).
- Always use the latest stable release of any software from my repositories.
- Verify checksums/signatures when available.
- Keep your system and dependencies up to date.
- Review the source code if you have concerns about security.