Mihaela M
87e3e5cbab
The reporting address was missing its @ and was unusable. The scope section described an unrelated static-site generator; replace it with the YAML parsing, validation, and emitting surface that is actually in scope (malformed-input DoS, misrepresented values, validation as a trust boundary).
36 lines
1.3 KiB
Markdown
36 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
If you believe you have found a security issue in PureYAML, please report it
|
|
privately. Do not open a public issue for security problems.
|
|
|
|
Email **mihaelamj@gmail.com** with:
|
|
|
|
- A description of the issue and its impact.
|
|
- Steps to reproduce, or a proof of concept.
|
|
- The affected version or commit.
|
|
|
|
You can expect an acknowledgement within a few days. Once the issue is confirmed,
|
|
a fix will be prepared and a release cut, after which the issue can be disclosed
|
|
publicly with credit to the reporter if desired.
|
|
|
|
## Supported versions
|
|
|
|
PureYAML is pre-1.0 and under active development. Security fixes are applied to
|
|
the `main` branch. Until a stable release exists, only the latest `main` is
|
|
supported.
|
|
|
|
## Scope
|
|
|
|
PureYAML parses, validates, and emits YAML. Reports about how the library
|
|
handles untrusted input are in scope, for example:
|
|
|
|
- Malformed or adversarial input that causes a crash, an unbounded loop, stack
|
|
overflow, or excessive memory or CPU use.
|
|
- Parser or emitter behavior that misrepresents input in a way a consumer could
|
|
rely on for a security decision (for example, a value that round-trips to a
|
|
different meaning).
|
|
- Incorrect rejection or acceptance of input by the validation layer that a
|
|
consumer treats as a trust boundary.
|