Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Vulnerability disclosure

Note

Project policy: draft. This page is the only home of Shiin’s vulnerability disclosure rules (ADR-0006).

What is a vulnerability

A way to get an action past Shiin’s decisions is a security vulnerability, even in a specification.

How to report

Report vulnerabilities privately. Do not open a public issue.

What happens

  • The maintainers acknowledge receipt privately.
  • A fix is prepared and coordinated with the reporter.
  • A public advisory is published when the fix is released.

Out of scope

  • Issues in third-party dependencies are reported to the maintainers of those dependencies.
  • Issues in the developer’s operating system or hardware are out of scope.