From 5a9433cbfc130ead0c1d5e12bcc7feb1ba82e9c5 Mon Sep 17 00:00:00 2001 From: Manit Arora Date: Tue, 6 Oct 2026 12:07:26 +1100 Subject: [PATCH 1/2] Create Security Policy document Added a security policy document outlining supported versions, vulnerability reporting process, and response procedures. --- Security.MD | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 Security.MD diff --git a/Security.MD b/Security.MD new file mode 100644 index 00000000..e8728d11 --- /dev/null +++ b/Security.MD @@ -0,0 +1,46 @@ +# Security Policy + +## Supported Versions + +Aoba Client is currently under active development. Security support will follow the latest stable release and development branch. + +| Version | Supported | +| --------------------- | ------------------ | +| Latest stable release | :white_check_mark: | +| Development (`main`) | :white_check_mark: | +| Older releases | :x: | + +Security support for development builds may depend on the severity of the issue and whether the affected component is already considered production-ready. + +## Reporting a Vulnerability + +**Please do not report security vulnerabilities through public GitHub issues.** + +For vulnerabilities affecting Aoba Client, please use GitHub's private security reporting mechanism: + +**GitHub → Security → Advisories → Report a vulnerability** + +When reporting an issue, please include: + +* A clear description of the vulnerability +* The affected QuantumGrid OS version or commit +* The affected component or package +* Steps required to reproduce the issue +* Any relevant logs, configuration, screenshots, or proof-of-concept information +* The potential security impact +* A suggested mitigation, if known + +Please provide enough information for the issue to be reproduced and investigated. + +## Response Process + +We will make a reasonable effort to: + +1. Acknowledge a vulnerability report. +2. Investigate and reproduce the issue. +3. Determine its severity and affected versions. +4. Develop and test a fix where practical. +5. Release or document the appropriate mitigation. +6. Publish a security advisory when disclosure is appropriate. + +Response and remediation times may vary depending on the severity, complexity, affected hardware, and whether the issue involves QuantumGrid code or an upstream dependency. From 78eca5c08ccfceca75c39c84cc075cedefbf7125 Mon Sep 17 00:00:00 2001 From: Manit Arora Date: Wed, 7 Oct 2026 11:17:00 +1100 Subject: [PATCH 2/2] Revise Security Policy for Aoba Client Updated the security policy to clarify supported versions and reporting procedures. And based on feedback received --- Security.MD | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/Security.MD b/Security.MD index e8728d11..f4d5cee8 100644 --- a/Security.MD +++ b/Security.MD @@ -2,29 +2,27 @@ ## Supported Versions -Aoba Client is currently under active development. Security support will follow the latest stable release and development branch. +Aoba Client is currently under active development. Security support follows the latest stable release and the master branch. -| Version | Supported | +| Version | Supported | | --------------------- | ------------------ | | Latest stable release | :white_check_mark: | -| Development (`main`) | :white_check_mark: | -| Older releases | :x: | - -Security support for development builds may depend on the severity of the issue and whether the affected component is already considered production-ready. +| `master` branch | :white_check_mark: | +| Older releases | :x: | ## Reporting a Vulnerability **Please do not report security vulnerabilities through public GitHub issues.** For vulnerabilities affecting Aoba Client, please use GitHub's private security reporting mechanism: - **GitHub → Security → Advisories → Report a vulnerability** When reporting an issue, please include: - * A clear description of the vulnerability -* The affected QuantumGrid OS version or commit +* The affected Aoba Client version or commit +* The Minecraft version used * The affected component or package +* Minecraft Launcher and Operating System * Steps required to reproduce the issue * Any relevant logs, configuration, screenshots, or proof-of-concept information * The potential security impact @@ -35,7 +33,6 @@ Please provide enough information for the issue to be reproduced and investigate ## Response Process We will make a reasonable effort to: - 1. Acknowledge a vulnerability report. 2. Investigate and reproduce the issue. 3. Determine its severity and affected versions. @@ -43,4 +40,4 @@ We will make a reasonable effort to: 5. Release or document the appropriate mitigation. 6. Publish a security advisory when disclosure is appropriate. -Response and remediation times may vary depending on the severity, complexity, affected hardware, and whether the issue involves QuantumGrid code or an upstream dependency. +Response and remediation times may vary depending on the severity, complexity, affected hardware, and whether the issue involves Aoba Client code or an upstream dependency.