Martin BallandClaude Opus 5.5
5b5810fe1f
OpenSSF Scorecard (v5.6.0, 4.0/10) flagged: - Token-Permissions: release.yml granted contents: write at the top level. Now read at the top, write on the release job only (same effective access). - Security-Policy: no SECURITY.md. Added one pointing to GitHub private vulnerability reporting (already enabled on the repo). - Vulnerabilities: ctutils 0.4.3 -> 0.4.7 (RUSTSEC-2026-0385); clipboard-win 5.4.1 -> 5.4.3 (yanked). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1.2 KiB
Security policy
Reporting a vulnerability
Please report security problems privately through GitHub: Report a vulnerability (Security tab › Advisories › Report a vulnerability).
Don't open a public issue or pull request for a vulnerability until a fix is released.
Useful to include:
- the WordCraft version or commit, and the platform (macOS, Windows, Linux, BSD, web);
- what an attacker can do, and what they need (a crafted document, MCP or control-channel access, a local account…);
- steps or a sample file that reproduce it.
We'll acknowledge the report, keep you updated while we work on a fix, and credit you in the advisory unless you'd rather not be named.
Supported versions
Fixes go into main and ship in the next release. Older releases don't get backported fixes.
Scope
In scope: anything that lets a document, file, command, MCP or control-channel request, or network response read or write files it shouldn't, run code, leak data, or crash WordCraft and lose the user's work.
Crashes from hostile input count, because WordCraft treats every panic as a bug (see Never crash).