This document applies to all repositories under the CommitBrief organization. Individual repositories may publish a project-specific SECURITY.md that supplements this document.
Please do not open a public issue for security reports.
Send vulnerability reports privately to:
If GitHub Security Advisories are enabled on the affected repository, you may also use the private vulnerability reporting feature.
Include in your report:
- A clear description of the issue and its potential impact.
- Steps to reproduce, including a minimal proof-of-concept if possible.
- Affected version(s), operating system, and any relevant configuration.
- Your assessment of severity (low / medium / high / critical) — feel free to disagree with our final triage.
| Stage | Target window |
|---|---|
| Acknowledgment of report | within 5 business days |
| Initial triage and severity assessment | within 10 business days |
| Fix or mitigation timeline | shared once triage completes |
| Public advisory (after fix) | coordinated with reporter |
This is a maintainer-driven open source project, not a commercial product with an SLA. We will make a genuine best effort but cannot promise enterprise-grade response times.
We follow coordinated disclosure:
- You report privately.
- We triage and develop a fix.
- We release the fix in a patched version.
- We publish a security advisory crediting you (unless you prefer to remain anonymous), describing the issue, and noting the affected versions and the fix.
We will not publish details before a fix is available, and we ask you to do the same.
Security patches are issued for the latest released minor version of each project. commitbrief is past v1.0 and follows strict semver, so fixes land on the current release line and ship as the next patch or minor release — please upgrade to the latest version before reporting. Older minor versions do not receive backported patches.
We are happy to credit security reporters in release notes and advisories. Let us know your preferred name and (optionally) a contact URL.
The following are generally not considered security issues for the purposes of this policy:
- Vulnerabilities in third-party AI provider APIs (report to the provider directly).
- Issues that require physical access to a user's already-compromised machine.
- API key leakage caused by the user committing their own
.commitbrief/config.yml(we provide multiple safeguards; the residual risk is a user-environment concern). - Theoretical timing or side-channel attacks without a demonstrated practical impact.
Edge cases will be evaluated on a case-by-case basis. When in doubt, send the report and we will decide together.