| Version | Supported |
|---|---|
latest main |
✅ |
| latest 2 tags | ✅ |
| older | ❌ |
Please do not open a public issue for security problems.
Use GitHub's private vulnerability-reporting flow:
https://github.com/your-org/myproject/security/advisories/new
Alternative channel: email security@example.com — PGP-encrypt anything
sensitive; request the public key via the same address.
Please include:
- Affected version(s) / commit SHA.
- A minimal reproducer (inputs, command line, expected vs. actual).
- Your assessment of impact (crash / memory corruption / DoS / info leak).
- Whether you believe a CVE should be requested.
- Acknowledgment: within 72 hours.
- Initial triage: within 7 days.
- Fix + coordinated disclosure: severity-dependent; we aim for 90 days max.
Releases ship with a build provenance attestation, Sigstore keyless (cosign)
signatures, and both SPDX + CycloneDX SBOMs (see
.github/workflows/supply-chain.yml). The attestation is a GitHub artifact
attestation, which GitHub documents as SLSA v1.0 Build Level 2; no higher level
is claimed. Verify a release artifact:
cosign verify-blob --bundle <artifact>.bundle <artifact>
gh attestation verify <artifact> --repo <owner>/<repository>This project targets the controls scaffolded for OWASP ASVS L2, NIST SSDF, and
SLSA v1.0 Build Level 2. Downstream products assert their compliance posture in
their own SECURITY.md.