Skip to content

Latest commit

 

History

History
29 lines (21 loc) · 1.09 KB

SECURITY.md

File metadata and controls

29 lines (21 loc) · 1.09 KB
Raw

Security Guideline

This document explains how DepTracPy security issues are handled by the maintainers.

Reporting a security issue

If you think you have found a security issue in DepTracPy, we ask you not to use the bug tracker and to not publish it publicly. Instead, all security issues must be sent to [email protected].

Security bug bounties

DepTracPy is an Open-Source project where most of the work is done by volunteers. We appreciate that developers are trying to find security issues in DepTracPy and report them responsibly, but we are currently unable to pay bug bounties.

Process

In case of an incident being reported, we will...

  1. try to confirm the vulnerability.
  2. send an acknowledgement to the reporter, if the issue is confirmed
  3. start working on a patch
  4. prepare a security advisory to be published with the patch
  5. send the patch and advisory to the reporter for review
  6. apply the patch to all supported versions of Deptrac
  7. release a new version of Deptrac with the applied patch
  8. publish the advisory