This policy applies to every repository in the Kyanite organization.
The stack is experimental and pre-1.0. Only the latest commit on the default branch of each repository is supported. There are no backports or long-term support branches yet.
Please do not open public issues for security problems.
Report privately using either:
- GitHub's "Report a vulnerability" button under the affected repository's Security tab (preferred), or
- email security@kyanite.computer.
Please include:
- the affected repository and version/commit,
- a description of the issue and its impact,
- steps to reproduce or a proof of concept,
- any relevant logs, crash output, or hardware/target details.
- We aim to acknowledge reports within a few business days.
- We practice coordinated disclosure: we will work with you on a fix and a disclosure timeline before any public announcement.
- There is no bug-bounty program at this time. Credit will be given to reporters who wish to be named.