| # Security Policy |
|
|
| ## Supported Versions |
|
|
| Currently supported versions with security updates: |
|
|
| | Version | Supported | |
| |---------|-----------| |
| | 0.1.x | ✅ Yes | |
| | < 0.1 | ❌ No | |
|
|
| ## Reporting a Vulnerability |
|
|
| ### How to Report |
|
|
| **DO NOT** create public GitHub issues for security vulnerabilities. |
|
|
| Please report security vulnerabilities by email to: |
|
|
| 📧 **akram.alsubari@outlook.com** |
|
|
| 📧 **akram.alsubari87@gmail.com** (alternative) |
|
|
| ### What to Include |
|
|
| When reporting a vulnerability, please include: |
|
|
| - Description of the vulnerability |
| - Steps to reproduce (code examples if possible) |
| - Affected versions |
| - Potential impact |
| - Any suggested fixes (optional) |
|
|
| ### What to Expect |
|
|
| | Step | Timeline | Description | |
| |------|----------|-------------| |
| | 1 | Within 48 hours | Acknowledgment of receipt | |
| | 2 | Within 5-7 days | Initial assessment and confirmation | |
| | 3 | Within 14 days | Fix development or mitigation plan | |
| | 4 | Within 30 days | Release of security update | |
|
|
| ### Vulnerability Acceptance |
|
|
| If the vulnerability is accepted: |
| - You will receive credit in the release notes (unless you prefer to remain anonymous) |
| - A security advisory will be published |
| - A patch will be released for supported versions |
|
|
| ### Vulnerability Decline |
|
|
| If the vulnerability is declined: |
| - You will receive a detailed explanation why |
| - The issue may be moved to a public discussion if appropriate |
| - No further action will be taken |
|
|
| ## Security Best Practices for Users |
|
|
| When using dytr: |
|
|
| 1. **Keep updated**: Always use the latest version |
| 2. **Validate inputs**: Sanitize any untrusted input before passing to the model |
| 3. **Use virtual environments**: Isolate dytr installations |
| 4. **Review code changes**: Check pull requests before merging |
|
|
| ## Security Updates |
|
|
| Security updates will be released as: |
|
|
| - **Patch versions** (0.1.x → 0.1.y) for critical fixes |
| - **Minor versions** (0.x → 0.y) for non-critical fixes |
|
|
| Watch the repository on GitHub to receive security update notifications. |
|
|
| ## Responsible Disclosure |
|
|
| We follow responsible disclosure practices: |
| - Reporters will be acknowledged (unless anonymous) |
| - Fixes will be released before public disclosure |
| - Coordinated disclosure with reporters |
|
|
| ## Contact |
|
|
| **Security Contact:** akram.alsubari@outlook.com |
|
|
|
|
| **Alternative Contact:** akram.alsubari87@gmail.com |
|
|
| ## Acknowledgment |
|
|
| We thank the security research community for helping keep dytr secure. |
|
|
