Skip to content

Security

← Project README · Code of Conduct · Contributing

This policy covers security issues involving the repository's scripts, dependencies, build tools, CI workflows, automation, and configuration.

It does not cover factual, mathematical, technical, or typographical errors in the study materials. See Content errors below.

Supported version

Security fixes are handled for the current default branch.

Older commits, archived artifacts, and historical releases are not maintained as separate supported versions.

Reporting a vulnerability

If you discover a security vulnerability, do not open a public issue containing technical details.

Report it privately through GitHub Private Vulnerability Reporting.

Please include, when possible:

Field What to include
Description A concise explanation of the issue.
Affected area The relevant file, workflow, dependency, script, or configuration.
Impact What an attacker or unexpected behavior could affect.
Reproduction Minimal steps or a proof of concept that makes the issue verifiable.
Mitigation Any suggested fix or workaround, if known.

Use sanitized examples. Do not include real credentials, access tokens, personal information, or unrelated sensitive data.

If private vulnerability reporting is unavailable, use the general-question form only to request a private contact channel. Do not include vulnerability details.

What to expect

After receiving a report, the maintainer will review the issue, attempt to reproduce it, and coordinate a fix and disclosure when appropriate.

Please do not disclose the vulnerability publicly until a fix is available or disclosure has been coordinated.

Reporters may be credited in a security advisory or release notes when appropriate unless they request anonymity.

Content errors

Factual or editorial mistakes are not security vulnerabilities unless they create an actual security risk. Use Contributing: issues and getting help for content, link, build, or documentation reports. The academic disclaimer explains the status of the study material.

Document Purpose
README.md Project overview, academic disclaimer, releases, and licensing.
CONTRIBUTING.md Contribution workflow, validation, licensing, and academic-integrity rules.
CODE_OF_CONDUCT.md Community standards and private conduct reporting.