Skip to content

SECURITY.md

Latest commit

 

History

History
30 lines (22 loc) · 1.27 KB

SECURITY.md

File metadata and controls

30 lines (22 loc) · 1.27 KB
Raw

Security Policy

Supported versions

Only the latest released version of @basicrum/basicrum-astro receives security fixes unless a release notice states otherwise. Users of the former @basicrum/astro package should follow the migration instructions.

Reporting a vulnerability

Do not report a suspected vulnerability in a public GitHub issue. Contact the maintainer privately through the Basicrum contact form and identify the report as a security issue.

Include, where possible:

  • the affected package version and the Astro and Node.js versions;
  • the vulnerable component and required configuration, for example the loader mode or a Content Security Policy;
  • reproducible steps or a minimal proof of concept;
  • the expected and observed security impact; and
  • any suggested remediation or disclosure constraints.

Avoid accessing data that does not belong to you, degrading a live service, or testing against production collectors without permission. Please allow time for the report to be reproduced and addressed before public disclosure.

General support questions and non-sensitive defects may use the repository's public issue tracker.