coves
A community based topic aggregation platform built on atproto
Star 12
Fork 0
Watch
coves SECURITY.md
1.2 kB · 21 lines
Markdown
at main

Security policy #

Supported versions #

Coves does not maintain multiple release lines. Security fixes land on main; operators should update to the newest revision.

Reporting a vulnerability #

Do not disclose a suspected vulnerability in a public issue, discussion or pull request before maintainers have had a chance to investigate.

Email support@coves.social with the subject Security vulnerability. This is the only private reporting channel; GitHub private vulnerability reporting is not enabled for this repository. Include, where possible:

  • the affected component and revision;
  • the impact and required preconditions;
  • reproduction steps or a minimal proof of concept;
  • any suggested mitigation; and
  • how you would like to be credited.

Leave out real user data and production credentials, and avoid unnecessary access to third-party systems. Maintainers will coordinate validation, the fix and disclosure with the reporter.

How Coves handles authentication, firehose trust, outbound requests and stored credentials is described in docs/SECURITY_MODEL.md, docs/SSRF_SECURITY.md and docs/CREDENTIAL_ENCRYPTION.md.