Security Policy

We take the security of Siegelkern seriously and appreciate the work of security researchers who help keep it safe.

Scope

This policy applies to every project in the siegelkern GitHub organization: the specification, the SDK and the operator.

Reporting a vulnerability

Please do not report a vulnerability through public GitHub issues, discussions or pull requests.

Report it privately by email to siegelkern@digits.schwarz. Include as much of the following as you can:

• the affected project and, where you know it, the version or commit — for the specification, the document and section;
• a description of the vulnerability and its impact;
• the steps to reproduce it, with any configuration they need;
• proof-of-concept code, screenshots or logs, where you have them;
• your name and affiliation, if you would like to be acknowledged.

Our response

• We work with you to validate and address the issue.
• We treat your report confidentially and share your details with third parties only with your consent, or where the law requires it.

Coordinated disclosure

We validate the vulnerability, assess its impact, and develop and test a fix, coordinating with you where that helps. Once a fix is available, we release it and disclose the vulnerability, and we agree the timing of the disclosure with you. We ask you to keep the vulnerability private until then.

Acknowledgements

We are grateful to everyone who reports a vulnerability responsibly. With your permission, we acknowledge your contribution in the release notes of the affected project.