open/repo-mailbox
1
0
Fork 0
Code Issues Releases 2 Activity
repo-mailbox/SECURITY.md
Kjell Tore Guttormsen 95ac7101ea docs(security): add SECURITY.md 
Vulnerability reporting policy for the C-axis trust program: private
disclosure address, response process, and an honest pre-1.0 supported-
versions statement (no fabricated version table, no SBOM claim).
2026-08-16 21:15:15 +02:00

1.1 KiB
Raw Blame History

Security policy

Reporting a vulnerability

Report privately to security@fromaitochitta.com - do not open a public issue. Canonical repository: https://git.fromaitochitta.com/open/repo-mailbox

Please include the affected version or commit, a minimal reproduction, and the impact you see. We acknowledge every report within 5 working days, agree a fix and disclosure timeline with the reporter, and aim to disclose within 90 days of the initial report.

Response process

  1. Acknowledge within 5 working days.
  2. Triage and confirm severity within 10 working days.
  3. Develop and test a fix.
  4. Publish an advisory and credit the reporter unless they prefer to remain anonymous.

Supported versions

This project is pre-1.0 (a single continuous 0.x line, currently in the 0.25 series) and carries no parallel maintenance branches. Only the latest tagged release receives security fixes; please upgrade to the latest release before reporting.

Advisories

Security-relevant fixes are recorded in CHANGELOG.md. Given the project's current scale, we do not yet publish separate signed advisories.