Skip to content

Security: OpenDIF/opendif-core

Security

SECURITY.md

Security Policy

Supported Versions

Note: We do not currently have versioning implemented. Versioning support will be added in the future. For now, all security updates will be applied to the main branch.

Once versioning is implemented, we will update this section with supported versions and their security update policies.

Reporting a Vulnerability

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability, please report it privately using one of the following methods:

  • GitHub Private Vulnerability Reporting: Use the "Report a vulnerability" button on the Security tab of this repository

What to Include

When reporting a vulnerability, please include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

Response Timeline

  • Initial Response: Within 48 hours
  • Status Update: Within 7 days
  • Resolution: Depends on severity and complexity

We appreciate your responsible disclosure and will acknowledge your contribution once the vulnerability is confirmed and addressed.

Disclosure Policy

  • We will notify you when we receive your report
  • We will keep you informed of our progress
  • We will credit you for the discovery (unless you prefer to remain anonymous)
  • We will coordinate public disclosure after a fix is available

There aren’t any published security advisories