We take the security of Shumoku seriously and appreciate responsible disclosure.
Reporting a vulnerability
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Instead, report privately through either of these channels:
- GitHub Security Advisory (preferred): open a private advisory.
- Email: contact@shumoku.dev.
What to include
To help us understand and reproduce the issue, please include as much of the following as you can:
- Impact — what an attacker can achieve, and which component is affected (library, CLI, Server, Editor, or a specific plugin).
- Affected versions — the version(s) where you observed the issue.
- Steps to reproduce — a minimal, reliable reproduction.
- Proof of concept — a brief summary or snippet, if you have one.
- Suggested fix or mitigation — optional, but welcome.
What to expect
- We will acknowledge your report and investigate it as our time and resources allow, and work with you on a fix and coordinated disclosure.
- Shumoku is an early-stage open-source project. There is currently no commercial SLA or guaranteed response time. We will do our best on a best-effort basis.
- We ask that you give us a reasonable opportunity to address the issue before any public disclosure, and that you avoid accessing or modifying other users’ data while researching.
Supported versions
Security fixes are generally applied to the latest released version. Older versions are addressed on a best-effort basis only. We recommend always running a current release.
No warranty
Shumoku is free and open-source software provided under the AGPL-3.0 license, as-is and without warranty of any kind, as described in the LICENSE. Reporting a vulnerability does not create any warranty, support obligation, or service-level commitment. We are nonetheless grateful for responsible disclosure and will work with reporters in good faith.