The purpose of this document is to outline how Chameleon's maintainers will handle any Security Vulnerabilities discovered.
We provide security patches for the latest release of Chameleon. This means that we will only address security vulnerabilities that affect the most recent version of this framework.
| Version | Supported |
|---|---|
0.19.x |
✅ |
< 0.19.x |
❌ |
If you discover a security vulnerability in Chameleon, we encourage you to report it to us as soon as possible so that we can investigate and address the issue.
You can report a security vulnerability in Chameleon by:
- Create a vulnerability report on our GitHub repository.
- Send an email to [email protected].
When reporting a security vulnerability, please provide as much detail as possible about the issue, including how it can be reproduced and what the potential impact of the vulnerability may be.
We take the security of Chameleon very seriously. As such, we encourage responsible disclosure of security vulnerabilities in Chameleon. If you report a security vulnerability to us responsibly, we will credit you when we publish a Security Advisory.
We define responsible disclosure as follows:
- Disclosing the vulnerability directly to us, rather than publicly disclosing it.
- Allowing us a reasonable amount of time to address the vulnerability before publicly disclosing it.
- Not exploiting the vulnerability or any related vulnerabilities to gain unauthorised access to systems or data.
By following this Security Policy, we aim to maintain the security of Chameleon and our users.
If you have any questions or concerns about this policy or Chameleon's security practices, please do
not hesitate to contact us at [email protected].