27 lines
1 KiB
Markdown
27 lines
1 KiB
Markdown
# Security policy
|
|
|
|
For Morphit's full security posture, threat model, and responsible-disclosure
|
|
process, please see [`docs/SECURITY.md`](docs/SECURITY.md).
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Two channels, in order of preference:
|
|
|
|
1. **Matrix DM** to **`@agorise:matrix.org`** — fastest path to a real human
|
|
on the project. End-to-end encrypted by default in Element / most Matrix
|
|
clients. Use this for anything sensitive enough that a passive observer
|
|
shouldn't see it.
|
|
2. **Confidential issue** at
|
|
[git.agorise.net/agorise/morphit](https://git.agorise.net/agorise/morphit) —
|
|
Forgejo supports the **Confidential** flag on issues.
|
|
|
|
We commit to:
|
|
|
|
- Acknowledging receipt within **72 hours**
|
|
- Triaging severity within **7 days**
|
|
- Coordinating a fix-and-disclose timeline with you
|
|
- Crediting your finding in the project changelog (with your consent)
|
|
|
|
For full disclosure-program details (severity ladder, scope, what's
|
|
out-of-scope, the discretionary recognition program), read
|
|
[`docs/SECURITY.md`](docs/SECURITY.md).
|