32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Do not file a public GitHub issue for security vulnerabilities.**
|
|
|
|
Please report security issues privately using one of:
|
|
|
|
1. **[GitHub Private Vulnerability Reporting](https://github.com/plastic-labs/honcho/security/advisories/new)** (preferred)
|
|
2. Email **<hello@plasticlabs.ai>** with subject line `[SECURITY] …`
|
|
|
|
Include as much of the following as you can:
|
|
|
|
- Description of the issue and its impact
|
|
- Steps to reproduce, or a proof of concept
|
|
- Affected component (API, deriver, auth/JWT, SDK, managed offering, etc.)
|
|
- Honcho version or image tag, and whether you are on managed or self-hosted
|
|
|
|
Honcho stores conversational data and peer representations. **Do not** attach production user content, API keys, JWTs, or other secrets to a report unless we explicitly ask for a redacted sample.
|
|
|
|
## What to expect
|
|
|
|
We will acknowledge valid reports as soon as we can and will keep you updated on remediation status. Please give us a reasonable window to investigate and fix before any public disclosure.
|
|
|
|
## Supported versions
|
|
|
|
Security fixes are applied to the latest release on `main` and, when practical, to the most recent tagged release line. Older versions may not receive backports.
|
|
|
|
## Non-security bugs
|
|
|
|
For ordinary bugs, memory/recall quality issues, and feature requests, use the [issue templates](https://github.com/plastic-labs/honcho/issues/new/choose).
|