1.4 KiB
Security Policy
Reporting a Vulnerability
If you have discovered a security vulnerability in LibHaLo or the surrounding ecosystem, please don't report it using public issues. Instead, please either report a Security Advisory, or just contact project maintainers:
- Michał Leszczyński (ml@arx.sh)
- Cameron Robertson (cameron@arx.sh)
Please address all persons listed above to let us look at the security issue quicker.
Project maintainers will do their best to inspect the reported security vulnerability as fast as possible. The security vulnerability might be resolved in one or more of the following ways:
- The new version of the project is released with the security issue resolved. We will do our best to notify affected parties before or after the fixed build is released.
- We will find out how to mitigate the issue with the existing versions of the project. A note will be published, describing how to mitigate the issue.
- The security issue will turn out to be impossible to fix and we will publish a note about that.
All notes mentioned above will be publicly announced after certain reasonable date set by the project maintainers. The project maintainers might notify certain entities before the note is publicly available. Per request, we will include the information about the person who discovered the vulnerability, or this information will be kept entirely private.