Skip to content

Latest commit

 

History

History
49 lines (32 loc) · 2 KB

SECURITY.md

File metadata and controls

49 lines (32 loc) · 2 KB

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in ts-runtime-picker, please follow these steps to report it:

1. Do Not Open Public Issues

Please do not open a public issue in the repository. Instead, report the vulnerability privately.

2. Send Us a Direct Message

Send a direct email to the maintainers at:

[email protected]

Alternatively, you can open a private issue in this repository with the label security and we will handle it privately.

3. What to Include in Your Report

When reporting a security vulnerability, please include:

  • A detailed description of the vulnerability.
  • Steps to reproduce the vulnerability.
  • Sample code or relevant configuration files.
  • Your environment details (e.g., Node.js version, operating system, etc.).

4. What We Do Next

Once we receive the report, we will:

  • Acknowledge your report and begin investigating the issue.
  • Fix the vulnerability and release a patch version.
  • Communicate the patch version and details to you before public disclosure.
  • After the fix is live, we will update the documentation and changelog to notify users of the vulnerability and its resolution.

5. Disclosure Timeline

Our goal is to resolve security issues promptly. Once the patch is released, we will:

  • Notify the reporter of the fix.
  • Release a new version of the package with a security update.
  • After the fix is live, we will disclose the issue and resolution in the changelog, without revealing sensitive details.

Security Best Practices

We recommend the following to secure your project when using ts-runtime-picker:

  • Regularly update your dependencies to ensure you are using the latest versions, especially security patches.
  • Consider using tools like Snyk or Dependabot to monitor vulnerabilities in dependencies.

License

ts-runtime-picker is licensed under the MIT License. See the LICENSE file for more details.