Public dry run dryrun-20b59dc46b72

Source commit: 20b59dc46b72103c2f8a516c692b5cc3d54fab19

Public tree identity: sha256:aaa5ac7b58b2a0d23c6b11e5f76324bf3839ca1f62653a83deb736932adcfbd9

SECURITY.md

@@ -0,0 +1,26 @@
+# Security policy
+
+Disasmer is pre-release software that executes untrusted Wasm and can delegate
+explicit host capabilities to attached nodes. Security reports are welcome even
+when the affected behavior has not shipped in a numbered release.
+
+## Supported versions
+
+Until the first public release, only the current `main` branch is supported.
+After releases begin, this table will identify supported release lines.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability. Email
+`ops@michelpaulissen.com` with:
+
+- the affected commit or release;
+- the relevant deployment mode (hosted, self-hosted, or attached node);
+- reproduction steps or a minimal proof of concept;
+- the security boundary or tenant scope that was crossed; and
+- any known mitigations.
+
+Please avoid accessing other users' data, disrupting hosted services, or
+retaining secrets while testing. We will acknowledge receipt, coordinate a fix
+and disclosure, and credit reporters who want to be named. No response-time or
+bounty commitment is made before the first public release.