Security related concerns will be prioritized according to perceived severity, and will be resolved quickly, correctly, and openly, to the best of this maintenance team's ability.
This policy does not guarantee bug-free software.
This policy is a good-faith promise to acknowledge and address all responsibly reported issues in a timely manner.
All of the maintainers of this project appreciate you, and your time and efforts to improve the quality of this software.
| Range | Version | Supported |
|---|---|---|
| Greater than or equal to | 1.1.x | ✅ |
| Less than or equal to | 1.0.x | ❌ |
Please open an issue on GitHub. Yes, really.
Higher quality software is built when all issues, regardless of severity, are worked on publicly and openly.
Education should be risk-free and reward-full. By keeping all issues open, everyone is held accountable and everyone is free to learn from everyone else's actions (or lack of them.)
- First responders will reply within 24 hours
- Issues that include reproduction steps will be confirmed within 48 hours
- Accepted security issues will have a pull request within 72 hours
- Merging to master will happen after manual confirmation, and after any related unit/integration tests are confirmed passing
- New releases of the software will happen on the soonest available Tuesday, never on Fridays or weekends
If your security issue is declined for any reason, please do not get upset - we are in this together.
If you disagree with how an issue is worked on or resolved, please include more clearly communicated instructions in your reply to help everyone understand why you feel differently than the people working on it.
Thank you very much in advance for your time and patience.
Software security is hard. Everyone involved with this project takes it extremely seriously.
With your help, we will improve.