This security policy applies to all versions of the pooolit software maintained under this repository. It outlines how security issues should be reported and what users can expect in terms of disclosure and response timelines.
If you believe you have discovered a security vulnerability in pooolit, we strongly encourage you to report it responsibly.
- Contact Email: mgopi@ucdavis.edu
- Encryption: We support encrypted communication via PGP (see below)
- PGP Key: (Insert your public PGP key or link here)
- Signature Verification: All security patches and official communication can be verified using this key.
Please do not file public issues for security vulnerabilities.
We aim to respond to all security reports within 3 business days, and to provide a resolution or mitigation plan within 7–14 days, depending on the complexity and severity of the issue.
| Version | Supported | Notes |
|---|---|---|
test123 |
✅ | Actively supported |
| older versions | May not receive security updates |
We recommend using the latest stable release to ensure the highest level of security and support.
- Primary Contact: mgopi@ucdavis.edu
- PGP Key (optional): (add URL or inline block here if available)
Thank you for helping keep pooolit and its users safe!
Here’s a Credit Policy section you can include in your SECURITY.md or in a separate CREDITS.md file to formally acknowledge contributors who report security issues:
⸻
🏆 Credit Policy
We believe in recognizing and thanking individuals who help make pooolit more secure.
✔️ Eligibility for Credit
You may be publicly credited in our repository or release notes if: • You are the first to report a previously unknown, valid security issue. • You provide a clear, actionable report that helps us understand and resolve the issue. • You give us a reasonable time to fix the issue before disclosing it publicly.
📋 What We Offer • Public acknowledgment in our changelog, release notes, or a dedicated SECURITY-CREDITS.md file. • Optionally, a swag reward or thank-you gift (if applicable and feasible). • A chance to be included in future security hall of fame pages.
🛑 Exclusions
We may not offer public credit if: • The issue is already known or previously reported. • The report is vague, incomplete, or not reproducible. • The issue is not considered a security vulnerability by our team.
If you’d prefer not to be credited, please let us know when reporting the issue.
⸻
Would you like me to help draft a SECURITY-CREDITS.md file too?