mirror of
https://github.com/ohmyzsh/ohmyzsh.git
synced 2024-11-22 13:02:32 +08:00
1868c15ec6
huntr.dev has pivoted to ML/AI-only vulnerability reporting, and we are now already using GitHub's private vulnerability reports.
24 lines
953 B
Markdown
24 lines
953 B
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
At the moment Oh My Zsh only considers the very latest commit to be supported.
|
|
We combine that with our fast response to incidents and the automated updates
|
|
to minimize the time between vulnerability publication and patch release.
|
|
|
|
| Version | Supported |
|
|
|:-------------- |:------------------ |
|
|
| master | :white_check_mark: |
|
|
| other commits | :x: |
|
|
|
|
In the near future we will introduce versioning, so expect this section to change.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
**Do not submit an issue or pull request**: this might reveal the vulnerability.
|
|
|
|
Instead, you should email the maintainers directly at: [**security@ohmyz.sh**](mailto:security@ohmyz.sh),
|
|
or using the link to [privately report a vulnerability with GitHub](https://github.com/ohmyzsh/ohmyzsh/security/advisories/new).
|
|
|
|
We will deal with the vulnerability privately and submit a patch as soon as possible.
|