Use GitHub's private vulnerability reporting:
- Navigate to the Security tab of any package's repository (or this incubator).
- Click "Report a vulnerability."
- Fill in the form. Reports are private until the maintainer acknowledges.
If GitHub's mechanism is unavailable, open a minimal public issue stating only that you have a vulnerability report and want a private channel. The maintainer will respond with a contact path within 48 hours.
90 days from acknowledged report to public disclosure. Earlier coordinated disclosure is acceptable when:
- A patched release is available on PyPI
- A CVE has been assigned (if applicable)
- The reporter agrees to the timing
In scope:
- Code execution, denial of service, unauthorized access, or data integrity vulnerabilities in any package shipped from this incubator
- Supply-chain concerns (build provenance, dependency tampering)
- HMAC verification weaknesses in any webhook helpers shipped here
Out of scope:
- Issues in upstream packages we depend on (report those upstream)
- Misconfiguration in user applications consuming our packages
- Theoretical concerns without a concrete exploit path
| Stage | Target time |
|---|---|
| Acknowledgment | 48 hours |
| Triage decision | 7 days |
| Patch development | varies; updates every 7 days during active work |
| Public disclosure + advisory | within 90 days unless coordinated otherwise |
None at this time. Pre-release.