We take security seriously. If you discover a security vulnerability, please report it responsibly.
- Do NOT create a public GitHub issue for security vulnerabilities
- Use GitHub's private vulnerability reporting (preferred)
- Or email:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
| Action | Timeframe |
|---|---|
| Acknowledgment | Within 48 hours |
| Status update | Every 7 days |
| Resolution | Depends on severity |
- We'll coordinate disclosure timing with you
- With permission, we'll credit you in the security advisory
| Version | Supported |
|---|---|
| Latest | Yes |
| Previous major | Security fixes only |
| Older | No |
This repository follows security best practices:
- Dependencies monitored by Dependabot
- GitHub Actions pinned to SHA
- Secrets never committed (see
.gitignore) - Push protection enabled (recommended)
In your repository settings, consider enabling:
- Secret scanning - Detects committed secrets
- Push protection - Blocks pushes with secrets
- Dependabot alerts - Notifies of vulnerable dependencies
- Code scanning - Finds vulnerabilities via CodeQL
See GitHub Security Features for setup instructions.