mirror of
https://github.com/storytold/wordcraft.git
synced 2026-11-09 11:50:20 -06:00
Martin BallandClaude Opus 5.5
5b5810fe1f
OpenSSF Scorecard (v5.6.0, 4.0/10) flagged: - Token-Permissions: release.yml granted contents: write at the top level. Now read at the top, write on the release job only (same effective access). - Security-Policy: no SECURITY.md. Added one pointing to GitHub private vulnerability reporting (already enabled on the repo). - Vulnerabilities: ctutils 0.4.3 -> 0.4.7 (RUSTSEC-2026-0385); clipboard-win 5.4.1 -> 5.4.3 (yanked). Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
27 lines
1.2 KiB
Markdown
27 lines
1.2 KiB
Markdown
# Security policy
|
||
|
||
## Reporting a vulnerability
|
||
|
||
Please report security problems privately through GitHub:
|
||
**[Report a vulnerability](https://github.com/storytold/wordcraft/security/advisories/new)**
|
||
(Security tab › Advisories › Report a vulnerability).
|
||
|
||
Don't open a public issue or pull request for a vulnerability until a fix is released.
|
||
|
||
Useful to include:
|
||
- the WordCraft version or commit, and the platform (macOS, Windows, Linux, BSD, web);
|
||
- what an attacker can do, and what they need (a crafted document, MCP or control-channel access, a local account…);
|
||
- steps or a sample file that reproduce it.
|
||
|
||
We'll acknowledge the report, keep you updated while we work on a fix, and credit you in the advisory unless you'd rather not be named.
|
||
|
||
## Supported versions
|
||
|
||
Fixes go into `main` and ship in the next release. Older releases don't get backported fixes.
|
||
|
||
## Scope
|
||
|
||
In scope: anything that lets a document, file, command, MCP or control-channel request, or network response read or write files it shouldn't, run code, leak data, or crash WordCraft and lose the user's work.
|
||
|
||
Crashes from hostile input count, because WordCraft treats every panic as a bug (see [Never crash](AGENTS.md)).
|