31 lines
1.2 KiB
Markdown
31 lines
1.2 KiB
Markdown
|
# Security Policy
|
||
|
|
|
||
|
|
## Supported Versions
|
||
|
|
|
||
|
|
Only the latest ISO build receives security updates. There are no LTS releases.
|
||
|
|
|
||
|
|
| Version | Supported |
|
||
|
|
|---------|-----------|
|
||
|
|
| latest (rolling) | ✅ |
|
||
|
|
|
||
|
|
## Reporting a Vulnerability
|
||
|
|
|
||
|
|
Please **do not** report security vulnerabilities through public GitHub issues, discussions, or pull requests.
|
||
|
|
|
||
|
|
Instead, report via **GitHub Private Vulnerability Reporting** for this repository. If that's unavailable, email `ash8820@proton.me`.
|
||
|
|
|
||
|
|
When reporting, include:
|
||
|
|
|
||
|
|
- The ISO build date or commit SHA
|
||
|
|
- A description of the issue and why it's security-sensitive
|
||
|
|
- Steps to reproduce or a proof of concept
|
||
|
|
- Any relevant logs, payloads, or screenshots
|
||
|
|
- The potential impact
|
||
|
|
- Suggested mitigations or fixes, if known
|
||
|
|
|
||
|
|
You can expect an acknowledgment within 3 business days. After assessment, I'll work on a fix and coordinate disclosure timing when appropriate.
|
||
|
|
|
||
|
|
## Scope
|
||
|
|
|
||
|
|
This covers the ISO build system (`buildiso`, profiles, overlays) and the live environment. For issues in custom packages (calamares, branding, keyring), report to the [antergos-packages](https://github.com/Antergos-NeXT/antergos-packages) repo. For upstream Calamares issues, report to [Calamares upstream](https://codeberg.org/calamares/calamares).
|