Security Policy

English | 中文

English

Reporting a Vulnerability

• Preferred: use GitHub Security Advisories on the affected repository (Security -> Advisories -> New draft).
• If Advisories are unavailable, contact the maintainers through a private channel. A dedicated security email will be published when ready.
• Please avoid public issues, pull requests, or discussions for security reports.

Supported Versions

• Default branch and the latest release are supported.
• Older versions receive best-effort fixes; you may be asked to upgrade.

Response Timeline

• Acknowledge within 72 hours.
• Initial assessment within 7 days.
• Coordinated disclosure target: within 90 days, adjusted by severity.

Disclosure Policy

• We practice responsible disclosure and will coordinate timelines with reporters.

中文

漏洞报告

• 首选：在受影响仓库使用 GitHub Security Advisories（Security -> Advisories -> New draft）。
• 如无法使用 Advisories，请通过私密渠道联系维护者。专用安全邮箱将随后公布。
• 请勿在公开 Issue/PR/Discussion 中披露安全问题。

支持范围

• 默认分支与最新发布版本处于支持范围。
• 旧版本为尽力支持，可能要求升级。

响应时限

• 72 小时内确认收到。
• 7 天内给出初步评估。
• 协调披露目标：90 天内（按严重程度调整）。

披露策略

• 遵循负责任披露，与报告者协商时间表。