Skip to content

Security: klaasnicolaas/python-spoolman

Security

Report a vulnerability

.github/SECURITY.md

Security Policy

We take the security of this project seriously. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

Reporting a Vulnerability

Do not submit security issues through GitHub Issues, Discussions, or Pull Requests.

If you believe you have discovered a security vulnerability, please submit it through GitHub’s private and encrypted reporting system:

  1. Open the Security tab of this repository
  2. Click “Report a vulnerability”
  3. Include a clear description, impact assessment (if known), and steps to reproduce

You can also open a private vulnerability report directly: https://github.com/klaasnicolaas/python-spoolman/security/advisories/new

This mechanism is the preferred and most secure way to report vulnerabilities, consistent with best practices across open-source projects.

Security vulnerabilities include issues that could affect users of this Python package, such as unsafe handling of remote API data, credential exposure, dependency-related vulnerabilities, or behavior that could allow unintended access to local or remote resources.

What Happens Next

After receiving your report, maintainers will:

  • Review the submitted information
  • Request additional details if necessary
  • Investigate and work toward a fix or mitigation
  • Communicate with you throughout the process

Maintainers aim to acknowledge vulnerability reports within 7 days when possible. After confirmation, we will work on a fix or mitigation and coordinate disclosure with the reporter.

For confirmed vulnerabilities, we generally aim to coordinate disclosure within 90 days. This is not a guaranteed deadline; the timeline may be shorter or longer depending on severity, exploitability, maintainer availability, and release coordination needs.

Coordinated Disclosure

To protect the community, please:

  • Avoid publicly disclosing the vulnerability until a fix has been released
  • Limit testing or reproduction to what is necessary for your report
  • Follow coordinated disclosure norms commonly used in open source

We appreciate your contribution to keeping this project secure!

There aren't any published security advisories