This policy applies to every repository in the Modulane organisation that does not have its own SECURITY.md.
Never open a public issue, discussion or pull request for a security vulnerability.
Report it privately instead:
- Open the Security tab of the affected repository.
- Select Report a vulnerability.
- Describe the issue, how to reproduce it, the affected versions and the impact you expect.
You will receive an initial response within 72 hours. Please allow a reasonable amount of time for a fix to be released before you disclose the vulnerability publicly.
Security fixes are released for the latest version of each project. Update to the latest version before reporting, and check that the issue still occurs.
Once a project reaches 1.0.0, the previous major version also receives critical security fixes for 6 months after the next major version is released. The Modulane maintainer may change this policy.
A repository's own SECURITY.md may list different supported versions.
Packages that Modulane repositories publish to npm are built and published by GitHub Actions with npm trusted publishing. Each one carries a provenance attestation that links it to the source commit and the workflow run that built it. You can verify the packages you have installed with:
npm audit signatures