2bef715211
Source commit: 20b59dc46b72103c2f8a516c692b5cc3d54fab19 Public tree identity: sha256:aaa5ac7b58b2a0d23c6b11e5f76324bf3839ca1f62653a83deb736932adcfbd9
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# Security policy
|
|
|
|
Disasmer is pre-release software that executes untrusted Wasm and can delegate
|
|
explicit host capabilities to attached nodes. Security reports are welcome even
|
|
when the affected behavior has not shipped in a numbered release.
|
|
|
|
## Supported versions
|
|
|
|
Until the first public release, only the current `main` branch is supported.
|
|
After releases begin, this table will identify supported release lines.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Do not open a public issue for a suspected vulnerability. Email
|
|
`ops@michelpaulissen.com` with:
|
|
|
|
- the affected commit or release;
|
|
- the relevant deployment mode (hosted, self-hosted, or attached node);
|
|
- reproduction steps or a minimal proof of concept;
|
|
- the security boundary or tenant scope that was crossed; and
|
|
- any known mitigations.
|
|
|
|
Please avoid accessing other users' data, disrupting hosted services, or
|
|
retaining secrets while testing. We will acknowledge receipt, coordinate a fix
|
|
and disclosure, and credit reporters who want to be named. No response-time or
|
|
bounty commitment is made before the first public release.
|