Security Policy¶
Reporting a vulnerability¶
Please report security vulnerabilities privately by email to contact@baibu.id. Put "Security" in the subject line.
Do not report security problems in public GitHub issues, pull requests or discussions.
Include as much of the following as you can:
- a description of the problem and its impact;
- the affected component, file or URL path, and the commit you tested;
- steps to reproduce, or a proof of concept;
- any suggested fix.
Do not include real personal data in your report. If you came across personal data while investigating, tell us what kind of data it was and where you found it, but do not send us a copy, and delete any copies you hold.
Supported versions¶
The project has not yet made a 1.0 release. Until then, only the main
branch is supported, and fixes are made there.
| Version | Supported |
|---|---|
main |
Yes |
| Anything else | No |
This policy will be updated when the first release is made.
What to expect¶
| Step | Target |
|---|---|
| Acknowledge your report | Within 14 days |
| Initial assessment and severity | Within 30 days |
| Fix for a critical or high-severity issue | As soon as we reasonably can, usually within 90 days of confirmation |
| Fix for other issues | In a planned release, based on severity |
We will keep you informed of progress, and tell you when the fix is published. These are targets, not guarantees. The project is maintained by a small team.
Disclosure¶
We ask that you give us reasonable time to fix a problem before you disclose
it publicly. We will agree a disclosure date with you, normally once a fix
is available on main. With your permission, we will credit you in the
fix's pull request or release notes.
Deployments¶
Each deployment of Baibu Community Edition is operated by its own organisation. Report problems with a specific deployment's configuration, hosting or data handling to that organisation. If the problem is in the code in this repository, report it to us as well.
Testing¶
Test only against your own local installation. Do not test against deployments you do not operate, and do not access, change or delete other people's data.