Supported template version: see .template-version on main. Security fixes apply to the latest Release Please tag.
| Version | Supported |
|---|---|
| latest | ✅ |
| < latest | ❌ |
See docs/THREAT_MODEL.md and docs/PRIVACY.md for data-boundary expectations.
Do not open public GitHub issues for security vulnerabilities.
- Use GitHub Private vulnerability reporting (Security → Advisories → Report a vulnerability), or
- Email the maintainers listed in
CODEOWNERSwith:- Description of the vulnerability
- Steps to reproduce
- Impact assessment
- Suggested fix (if any)
| Stage | Target |
|---|---|
| Acknowledgment | 3 business days |
| Initial assessment | 7 business days |
| Fix or mitigation plan | 30 days (severity-dependent) |
| Public disclosure | Coordinated with reporter |
- Dependabot alerts and weekly CVE triage: see
docs/SECURITY_TRIAGE.md - Maintainer orchestrator:
bash scripts/run-maintainer-gates.sh(weekly; full cycle omits--quick) - Secrets must never be committed (Gitleaks pre-commit enforced)
- Report dependency vulnerabilities via Dependabot; do not commit patched forks without review