Viewing is open to everyone. Downloading and starring need a GitHub sign-in.
Sign in with GitHub
SECURITY.md
v0.1.0-build.85
Latest
Commit ede38f5
Sign in with GitHub to download. Each download is recorded with your GitHub username.
| 1 | # Security |
| 2 | |
| 3 | CKey reads untrusted images and untrusted bytes, so parser and decoder bugs are security bugs. |
| 4 | |
| 5 | ## Reporting a problem |
| 6 | |
| 7 | Report a suspected vulnerability privately through GitHub: **Security → Report a vulnerability** on this repository. Please include: |
| 8 | |
| 9 | - the CKey version (`VERSION`, or `ckey_software_version()`), |
| 10 | - the platform and package (C library, npm `openckey`, NuGet `CKey`, Maven `org.openckey:ckey`, Swift package, CLI), |
| 11 | - the smallest input that shows the problem (an image, a `.ckey` file or the payload bytes). |
| 12 | |
| 13 | Do not open a public issue for a vulnerability. You will get a reply within seven days. |
| 14 | |
| 15 | ## Scope |
| 16 | |
| 17 | In scope: the C core (`src/`, `include/`), the `.ckey` reader, the SDKs under `sdk/`, the CLI, and the release artifacts built from `Stable-Release`. |
| 18 | |
| 19 | Out of scope: openckey.org, which is a separate service with its own reporting route at <https://openckey.org/report>. |
| 20 | |
| 21 | ## Supported versions |
| 22 | |
| 23 | Only the newest release tag on `Stable-Release` receives fixes. `scratch` and `community` are unreleased work. |