Security Policy

Thank you for taking the time to responsibly disclose any problems you find.

All security vulnerabilities should be reported by email to [email protected].

Your report will be acknowledged within 24 hours, and you will receive a more detailed response within 48 hours indicating the next steps in handling your report.

After the initial reply to your report, you will be kept informed of the progress being made towards a fix and official announcement. These updates will be sent at least every 5 days; in reality, this is more likely to be every 24-48 hours.

Disclosure follows a 5-step process:

1. 1.The security report is received and is assigned a primary handler. This person will coordinate the fix and release process.
2. 2.The problem is confirmed and a list of all affected versions is determined.
3. 3.Code is audited to find any potential similar problems.
4. 4.Fixes are prepared for all releases which are still under maintenance. These fixes are not committed to the public repository but rather held locally pending the announcement.
5. 5.On the embargo date, the changes are pushed to the public repository and new builds are deployed.

This process can take some time, especially when coordination is required with maintainers of other projects. Every effort will be made to handle the issue in as timely a manner as possible, however it is important to follow the process above to ensure that disclosure is handled consistently.

You can encrypt your report using the public key below. It is also available on MIT's key server and as a file.

uid

Nikita Tikhonov (security) <[email protected]>

fingerprint

EEBD 6848 A583 A1B4 F6B73B60 D177 918F C00B B74F

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEac+/LRYJKwYBBAHaRw8BAQdAxZdnBe5EWI4ZV33a9MpRdNtkB3c02mMriiV9
Cv88tQa0L05pa2l0YSBUaWtob25vdiAoc2VjdXJpdHkpIDxzZWN1cml0eUBuZWtp
dC5kZXY+iJAEExYKADgWIQTuvWhIpYOhtPa3O2DRd5GPwAu3TwUCac+/LQIbAwUL
CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDRd5GPwAu3T6iHAQDe0Q+0rjKMg2rf
TZ1lHXeKmIg1EW8ZB+W/z05ahnHpGwD5AbR0fCxiM5IMqHaEdwJl6fxE9TYDvM7g
NWoRdbiHIAe4OARpz78tEgorBgEEAZdVAQUBAQdAfGJto7sXSt0YbBUDkK901tpA
m08yaiqDJ0MgsytMFkgDAQgHiHgEGBYKACAWIQTuvWhIpYOhtPa3O2DRd5GPwAu3
TwUCac+/LQIbDAAKCRDRd5GPwAu3T4QBAP9v6yLLf9FVAnD3XNGzz9juTk/z+sSL
F9XiwmRXQJ31SQEA/QmBRPc35EFA+zA+wwx8beeeg6A8iYABIpXde15Xgw8=
=fKBT
-----END PGP PUBLIC KEY BLOCK-----

This policy is adapted from Rust's Security Policy.