Files

T

kingchenc 62ab84c472 chore(migration): switch org to wickra-lib and maintainer email to wickra.lib@gmail.com (#59 )

Introduce repo-metadata.toml as single source of truth for repo identity
(org slug, maintainer email, canonical URLs) and add sync-metadata.yml
workflow with a Python audit script that fails CI if any tracked file
drifts back to pre-migration values.

Bulk-replace across 24 tracked files:
- kingchenc/wickra -> wickra-lib/wickra (URL segment)
- kingchencp@gmail.com -> wickra.lib@gmail.com (maintainer email)
- @kingchenc -> @wickra-lib (CODEOWNERS mention only)

Person-name credits are preserved: LICENSE copyright holder, Cargo.toml
authors handle, and CHANGELOG historical @kingchenc reference all remain
unchanged. Crate / PyPI / npm package names also untouched.

Merge this PR only after the kingchenc/wickra -> wickra-lib/wickra org
transfer has happened on the GitHub side, otherwise all badges and
repository links 404 until the transfer is performed.

2026-05-30 12:18:10 +02:00

1.4 KiB

Raw Blame History

Security Policy

Supported versions

Wickra is pre-1.0. Security fixes are applied to the latest released 0.1.x version only; please upgrade to the newest release before reporting an issue.

Version	Supported
0.1.x (latest)	✅
older 0.1.x	❌

Reporting a vulnerability

Do not open a public issue for a security vulnerability.

Report it privately through one of:

GitHub's private vulnerability reporting ("Report a vulnerability" under the repository's Security tab), or
email to wickra.lib@gmail.com with a subject line starting with [wickra security].

Please include:

the affected version(s) and platform / language binding,
a description of the issue and its impact,
steps to reproduce, ideally a minimal proof of concept.

What to expect

An acknowledgement within 5 working days.
An assessment and, if confirmed, a planned fix with a target release.
Coordinated disclosure: we will agree on a disclosure date with you and credit you in the release notes unless you prefer to stay anonymous.

Scope

In scope: the published crates (wickra-core, wickra-data, wickra), the PyPI/npm packages, and the build/release workflows in .github/workflows/.

Out of scope: vulnerabilities in third-party dependencies (report those upstream; we track them via Dependabot and cargo-deny).