|
| 1 | +# Security Policy |
| 2 | + |
| 3 | +## Supported Versions |
| 4 | + |
| 5 | +Security fixes are provided for **currently supported release lines** of `switon/invoker` (`switon/invoker` on Packagist). |
| 6 | + |
| 7 | +| Version line | Supported | |
| 8 | +|--------------|-----------| |
| 9 | +| `1.x` (latest stable release) | Yes | |
| 10 | +| Older major/minor lines with no maintained tag | No | |
| 11 | + |
| 12 | +Check the latest release tag (for example `v1.0.1` on this repository) before reporting. |
| 13 | + |
| 14 | +## Reporting a Vulnerability |
| 15 | + |
| 16 | +**Please do not open a public GitHub issue for security vulnerabilities.** |
| 17 | + |
| 18 | +Use one of these channels: |
| 19 | + |
| 20 | +1. **GitHub private vulnerability reporting (preferred)** |
| 21 | + [Report a vulnerability](https://github.com/switon-php/invoker/security/advisories/new) |
| 22 | + |
| 23 | +2. **Email** |
| 24 | + |
| 25 | + |
| 26 | +### What to Include |
| 27 | + |
| 28 | +- Affected version (Composer constraint, tag, or commit) |
| 29 | +- Clear description of the issue and impact |
| 30 | +- Steps to reproduce, or a minimal proof of concept when possible |
| 31 | +- Any suggested fix or mitigation you have already identified |
| 32 | + |
| 33 | +## What We Will Do |
| 34 | + |
| 35 | +- Acknowledge receipt as soon as practicable (typically within a few business days) |
| 36 | +- Confirm whether the report affects supported versions |
| 37 | +- Work on a fix and coordinated disclosure |
| 38 | +- Publish a security advisory and patched release when appropriate |
| 39 | +- Credit reporters in the advisory when they wish to be named |
| 40 | + |
| 41 | +## Out of Scope |
| 42 | + |
| 43 | +The following are generally **not** treated as security vulnerabilities here: |
| 44 | + |
| 45 | +- Reports against unsupported or unmaintained version lines |
| 46 | +- Issues that require misconfiguration or deployment choices outside documented guidance |
| 47 | +- Denial-of-service scenarios with no practical impact on confidentiality or integrity at default settings |
| 48 | +- Vulnerabilities in third-party dependencies already fixed in a newer supported release of that dependency (please report upstream; we will bump dependencies as part of maintenance) |
| 49 | + |
| 50 | +For non-security bugs and feature requests, use the normal issue tracker on this repository. |
0 commit comments