mirror of
https://github.com/hanzoai/python-sdk.git
synced 2026-10-23 20:23:00 +00:00
zeekay
6d5dc78fcb
This repo is a fork, and its SECURITY.md still carried the upstream's contact — so a researcher who found a hole in what WE ship was told to mail a vendor who cannot fix it, and who would then know about a live vulnerability in our production before we did. Fourteen repos were in that state: datastore -> [email protected], git and its two worktrees -> [email protected], auto -> [email protected], calendar -> [email protected], dns -> [email protected], python-sdk -> [email protected], plus bot, gui-gates, gui-geist, playground and playground-oauthcb pointing at brand domains with no mailbox behind them. All of them now carry one policy and one address, [email protected], matching what cloud and gateway already used. The policy says out loud to report here rather than upstream, because the next fork will inherit the same file and the same instinct.
550 B
550 B
Security Policy
Reporting a vulnerability
Email [email protected] with details. We respond within 48 hours; critical issues receive same-day acknowledgment.
Report to us, not to the upstream this fork came from. They cannot fix what we ship, and routing a live vulnerability in our deployment to a third party tells someone else about it before it reaches the people who can close it.
Scope
This policy covers the code in this repository. For the broader Hanzo platform threat model, see hanzoai/hips.