Files

T

kingchenc 94cab88278 E3: add community health files

The repository had no contributor-facing documentation or automation
config. Add the standard set:

- CHANGELOG.md (Keep a Changelog format, 0.1.0-0.1.4 plus Unreleased)
- CONTRIBUTING.md (build/test steps, change standards, PolyForm-NC note)
- SECURITY.md (private reporting, supported versions)
- CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
- .github/ISSUE_TEMPLATE (bug report, feature request, config)
- .github/PULL_REQUEST_TEMPLATE.md
- .github/dependabot.yml (cargo, npm, pip, github-actions — the last
  keeps the D1 SHA pins current)
- .github/CODEOWNERS

2026-05-22 16:17:15 +02:00

1.4 KiB

Raw Blame History

Security Policy

Supported versions

Wickra is pre-1.0. Security fixes are applied to the latest released 0.1.x version only; please upgrade to the newest release before reporting an issue.

Version	Supported
0.1.x (latest)	✅
older 0.1.x	❌

Reporting a vulnerability

Do not open a public issue for a security vulnerability.

Report it privately through one of:

GitHub's private vulnerability reporting ("Report a vulnerability" under the repository's Security tab), or
email to kingchencp@gmail.com with a subject line starting with [wickra security].

Please include:

the affected version(s) and platform / language binding,
a description of the issue and its impact,
steps to reproduce, ideally a minimal proof of concept.

What to expect

An acknowledgement within 5 working days.
An assessment and, if confirmed, a planned fix with a target release.
Coordinated disclosure: we will agree on a disclosure date with you and credit you in the release notes unless you prefer to stay anonymous.

Scope

In scope: the published crates (wickra-core, wickra-data, wickra), the PyPI/npm packages, and the build/release workflows in .github/workflows/.

Out of scope: vulnerabilities in third-party dependencies (report those upstream; we track them via Dependabot and cargo-deny).