hanzoai/python-sdk
2
0
Fork 0
mirror of https://github.com/hanzoai/python-sdk.git synced 2026-10-23 20:23:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Report vulnerabilities to us, not to the upstream we forked

Browse Source 
This repo is a fork, and its SECURITY.md still carried the upstream's contact —
so a researcher who found a hole in what WE ship was told to mail a vendor who
cannot fix it, and who would then know about a live vulnerability in our
production before we did.

Fourteen repos were in that state: datastore -> [email protected], git and
its two worktrees -> [email protected], auto -> [email protected],
calendar -> [email protected], dns -> [email protected], python-sdk ->
[email protected], plus bot, gui-gates, gui-geist, playground and
playground-oauthcb pointing at brand domains with no mailbox behind them.

All of them now carry one policy and one address, [email protected], matching
what cloud and gateway already used. The policy says out loud to report here
rather than upstream, because the next fork will inherit the same file and the
same instinct.
This commit is contained in:
zeekay
2026-08-13 14:42:32 -07:00
parent 04a818ba12
commit f7b2eda6ca
1 changed files with 9 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+9 -21
View File
@@ -1,27 +1,15 @@
# Security Policy
## Reporting Security Issues
## Reporting a vulnerability
This SDK is generated by [Stainless Software Inc](http://stainless.com). Stainless takes security seriously, and encourages you to report any security vulnerability promptly so that appropriate action can be taken.
Email security@hanzo.ai with details. We respond within 48 hours; critical
issues receive same-day acknowledgment.
To report a security issue, please contact the Stainless team at security@stainless.com.
Report to us, not to the upstream this fork came from. They cannot fix what we
ship, and routing a live vulnerability in our deployment to a third party tells
someone else about it before it reaches the people who can close it.
## Responsible Disclosure
## Scope
We appreciate the efforts of security researchers and individuals who help us maintain the security of
SDKs we generate. If you believe you have found a security vulnerability, please adhere to responsible
disclosure practices by allowing us a reasonable amount of time to investigate and address the issue
before making any information public.
## Reporting Non-SDK Related Security Issues
If you encounter security issues that are not directly related to SDKs but pertain to the services
or products provided by Hanzo please follow the respective company's security reporting guidelines.
### Hanzo Terms and Policies
Please contact dev@hanzo.ai for any questions or concerns regarding security of our services.
---
Thank you for helping us keep the SDKs and systems they interact with secure.
This policy covers the code in this repository. For the broader Hanzo platform
threat model, see [hanzoai/hips](https://github.com/hanzoai/hips).