This document says how to report a security problem in Eonmark and what happens after you do. Eonmark is a single-player game with no network code before v0.2, so the attack surface is small, but file parsing (replays, RON data, settings) and the build and release tooling still deserve care.
Please do not open a public issue for a security problem.
- Preferred: GitHub private vulnerability reporting on this repository. Open the Security tab and choose "Report a vulnerability", or go to https://github.com/tonianev/eonmark/security/advisories/new.
- Fallback: email tonianev@gmail.com with "Eonmark security" in the subject.
Include the commit or release version, your macOS version and chip, the steps to reproduce, and, when relevant, the replay or data file that triggers the problem.
| Step | Commitment |
|---|---|
| Acknowledgement | Within 7 days of your report. |
| Assessment | You hear what was found and what will be done, or why the report is declined. |
| Fix | Ships in the next tagged release. A severe problem gets a point release. |
| Credit | In the release notes, if you want it. |
In scope:
- The
eonmarkbinary and theEonmark.appbundle published on GitHub Releases (from v0.1.0, M8). - The
sim-clitool. - The scripts under
scripts/and the GitHub Actions workflows under.github/workflows/.
Out of scope:
- Vulnerabilities in third-party crates. Report them upstream;
cargo denychecks advisories in CI. - Problems that need a modified binary or physical access to the machine.
- The GitHub platform itself.
Pre-alpha. Fixes land on main. From v0.1.0 only the latest tagged release receives fixes.
There is no bug bounty program.
Releases are ad-hoc signed and not notarized. Check the zip against the SHA256SUMS file on the release page as described in README.md.