Security Policy

Supported Versions

Only the master branch of the library will receive security updates. Security updates will NOT be applied to any previously published or released versions.

A new release version of the library will be published, if required, to address any security updates.

Reporting a Vulnerability

Please report any sensitive, critical, or urgent vulnerablities directly to David Conran (david@xyzzy.com.au) and create an issue saying you need to communicate an important security issue. i.e. Sensitive details in the email, General details in the Issue. Two different notification paths to help make sure it’s seen.

After assessing the issue, we will work out how we will handle the matter and let you know how to proceed.

If the vulnerablity is neither sensitive, critical, or urgent, please just create a new issue as per normal.

You should receive an initial response with in 48 (or so) hours typically. You should get updates on a security vulnerability report with in a week, probably much sooner. This project is supported completely on a ad-hoc volounteer basis, and has only a handful of main contributers so there could be unforseen delays. e.g. Vacations etc.

If you don’t hear from anyone with in two weeks & you think you should have, it’s probably safe to assume we have missed you’re messages. Please try again, or via another method or channel.

We will endeavour to keep the issue reporter(s) in the loop as much as practical, and address the reported issue as soon as feasible.