If you've found a security issue in __PKG_NAME__, please do not open a public GitHub issue. Use one of these channels instead:
- Preferred: Open a private security advisory on this repository. GitHub keeps the report private until we coordinate disclosure.
- Alternative: Email the maintainer (see the GitHub profile of the repository owner).
Please include enough detail to reproduce the issue: input, Go version, and the version of __PKG_NAME__ you're using.
This is a one-maintainer project. Best-effort response targets:
- Acknowledgement: within 7 days of report.
- Triage and severity assessment: within 14 days.
- Patch release for confirmed high-severity issues: as quickly as practical, typically within 14 days of triage.
If a report is rejected (not a vulnerability, out of scope), you'll get an explanation. If you disagree with the assessment, escalate by responding on the same advisory thread.
The latest minor of the current major plus the immediately preceding minor receive security fixes. Older minors do not.
| Version | Supported |
|---|---|
| Latest minor of the current major | ✓ |
| Previous minor of the current major | ✓ |
| Anything older | Upgrade |
When the next major ships, the same rule applies on the new major line; the latest minor of the prior major receives critical fixes for a 6-month transition window, then drops out of support.
In scope:
- Bugs in
__PKG_NAME__source code that lead to incorrect behavior in security-relevant contexts. - Build-time supply-chain issues with the package's own CI / release workflows.
Out of scope:
- Vulnerabilities in caller code that uses
__PKG_NAME__insecurely. - Performance issues that aren't a denial-of-service risk.
- Issues in Go's standard library — report those upstream to https://github.com/golang/go.