bearhub/SECURITY.md

Security Policy

Supported Versions

Security fixes are provided on a best-effort basis for:

• the latest Bearhub release
• the current main branch

Older releases may not receive security updates.

Reporting a Vulnerability

Please do not open public issues for undisclosed security vulnerabilities.

Use one of these channels:

1. GitHub Security Advisories (preferred):
   • Go to the repository Security tab
   • Create a private vulnerability report
2. If advisory reporting is unavailable, contact maintainers directly via GitHub.

Include as much detail as possible:

• affected Bearhub version
• platform details (Arch version, Python version, desktop session)
• reproduction steps
• expected vs. actual behavior
• logs, stack traces, and proof-of-concept (if available)

Response Process

Maintainers will:

• acknowledge the report as soon as possible
• validate impact and scope
• prepare and publish a fix
• credit reporters where appropriate (if desired)

Disclosure

Please allow reasonable time for validation and patching before public disclosure.

Once fixed, we will disclose:

• impacted versions
• mitigation/fix guidance
• release references containing the patch