mirror of
https://github.com/hanzoai/python-sdk.git
synced 2026-10-23 20:23:00 +00:00
zeekay
f7b2eda6ca
This repo is a fork, and its SECURITY.md still carried the upstream's contact — so a researcher who found a hole in what WE ship was told to mail a vendor who cannot fix it, and who would then know about a live vulnerability in our production before we did. Fourteen repos were in that state: datastore -> [email protected], git and its two worktrees -> [email protected], auto -> [email protected], calendar -> [email protected], dns -> [email protected], python-sdk -> [email protected], plus bot, gui-gates, gui-geist, playground and playground-oauthcb pointing at brand domains with no mailbox behind them. All of them now carry one policy and one address, [email protected], matching what cloud and gateway already used. The policy says out loud to report here rather than upstream, because the next fork will inherit the same file and the same instinct.
16 lines
550 B
Markdown
16 lines
550 B
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Email security@hanzo.ai with details. We respond within 48 hours; critical
|
|
issues receive same-day acknowledgment.
|
|
|
|
Report to us, not to the upstream this fork came from. They cannot fix what we
|
|
ship, and routing a live vulnerability in our deployment to a third party tells
|
|
someone else about it before it reaches the people who can close it.
|
|
|
|
## Scope
|
|
|
|
This policy covers the code in this repository. For the broader Hanzo platform
|
|
threat model, see [hanzoai/hips](https://github.com/hanzoai/hips).
|