From b450ac4bce227d6129f25c15cbb63560f712c6a3 Mon Sep 17 00:00:00 2001 From: Viljami Kuosmanen Date: Sat, 15 Aug 2026 06:42:33 +0300 Subject: [PATCH 1/2] docs: add vulnerability disclosure policy --- SECURITY.md | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..c9e4cfa --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,27 @@ +# Security Policy + +## Reporting a vulnerability + +Please report suspected security vulnerabilities privately. Email **viljami@viljami.io** with `SECURITY` in the subject line. Do not open a public GitHub issue for an unpatched vulnerability. + +Please include, where possible: + +- the affected package and version; +- a clear description of the vulnerability and its potential impact; +- reproduction steps or a minimal proof of concept; +- any relevant logs, configuration, or environment details; and +- whether the issue is publicly known or being actively exploited. + +Please avoid including secrets or personal data in the report. If sensitive material is necessary, ask for a secure transfer method first. + +## What to expect + +We will acknowledge receipt as soon as practical, investigate in good faith, and keep the reporter informed when there is meaningful progress. We will coordinate disclosure with the reporter where possible, including credit if requested. There is no guaranteed response or remediation deadline. + +## Scope and safe harbor + +This policy covers security vulnerabilities in the code maintained in this repository and released versions of `openapi-client-axios`. Do not test against systems or data that you do not own or have explicit permission to assess, and do not intentionally access, modify, or retain data belonging to others. + +We ask security researchers acting in good faith to avoid service disruption, privacy violations, and destructive testing. We will not pursue legal action for good-faith research that follows this policy, stays within scope, and stops when a vulnerability is confirmed. + +This is a voluntary vulnerability-disclosure policy. It does not grant permission to test third-party systems and does not replace any legal or regulatory obligation that may apply. From c70a895992405670b1357529bfa211ed015a807f Mon Sep 17 00:00:00 2001 From: Viljami Kuosmanen Date: Sat, 15 Aug 2026 06:46:40 +0300 Subject: [PATCH 2/2] docs: use project security contact --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index c9e4cfa..8af386d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ## Reporting a vulnerability -Please report suspected security vulnerabilities privately. Email **viljami@viljami.io** with `SECURITY` in the subject line. Do not open a public GitHub issue for an unpatched vulnerability. +Please report suspected security vulnerabilities privately. Email **support@openapistack.co** with `SECURITY` in the subject line. Do not open a public GitHub issue for an unpatched vulnerability. Please include, where possible: