If you discover a security vulnerability in Omniplex, please report it responsibly. Do not open a public GitHub issue as this could expose the vulnerability to bad actors.
- Email - Send a detailed report to security@omniplex.gg
- Include - Version affected, description of vulnerability, steps to reproduce, and potential impact
- Wait - We will acknowledge receipt within 48 hours
- Collaborate - Work with us on a fix before public disclosure
Subject: [SECURITY] Vulnerability Report
Application Version: 0.1.0
Vulnerability Type: [e.g., XSS, CSRF, Authentication Bypass, etc.]
Affected Component: [e.g., search functionality, login, settings]
Description:
[Clear description of the vulnerability]
Steps to Reproduce:
[Detailed steps]
Potential Impact:
[What could an attacker do with this vulnerability?]
Suggested Fix (optional):
[If you have suggestions for fixing it]
Timeline Preference:
[How much time would you like before public disclosure?]
- Day 0: Vulnerability reported
- Day 1: Acknowledgment and initial assessment
- Days 2-7: Development and testing of fix
- Day 8: Security patch released (if critical)
- Day 30: Public disclosure and credit in release notes
For critical vulnerabilities (CVSS 9.0-10.0), we may accelerate this timeline.
We provide security updates for:
| Version | Supported |
|---|---|
| 0.1.x | ✅ Current |
| < 0.1 | ❌ Not supported |
- Keep Omniplex updated to the latest version
- Use strong, unique passwords for your accounts
- Never share your authentication tokens or API keys
- Report suspicious activity to support@omniplex.gg
- Review our Privacy Policy
- Follow the CONTRIBUTING.md security guidelines
- Never commit sensitive data (tokens, API keys, credentials)
- Use the secure logger system that automatically redacts sensitive data
- Run security checks before submitting pull requests
- Report security issues in dependencies via the reporting process above
- v0.1.0 - No known vulnerabilities
We regularly update dependencies to patch security vulnerabilities. Check CHANGELOG.md for security-related updates.
To check your local installation:
# Check for vulnerable dependencies
bun audit
# Update all dependencies safely
bun upgrade --latestWe follow the responsible disclosure principles:
- No Public Disclosure Before Fix - We won't publicly discuss vulnerabilities until a patch is available
- Timely Response - We respond quickly to vulnerability reports
- Good Faith Effort - We won't pursue legal action against researchers reporting responsibly
- Credit - We credit security researchers in our release notes (with permission)
- Security Issues: security@omniplex.gg
- Code of Conduct Violations: conduct@omniplex.gg
- General Support: support@omniplex.gg
For highly sensitive reports, you may encrypt your email using our PGP key:
Coming soon - check back for updates
This policy may be updated from time to time. Changes will be reflected in our repository with a new commit message clearly indicating "security policy update".
Thank you for helping keep Omniplex secure! 🔒