This document outlines security procedures and general policies for the migaloo-bots project.
Security is something we take seriously at White Whale. Thanks for taking the time to improve the security of migaloo-bots. We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions.
Please report security bugs by emailing White Whale at security@whitewhale.money. Do not report it publicly on the GitHub issues tracker. Your report should detail the necessary steps to reproduce the security issue. We will acknowledge your email within 48 hours and send a detailed response indicating the next steps. After the initial reply to your report, we will keep you informed of the progress toward a fix and full announcement and may ask for additional information or guidance.
Report security bugs in third-party modules to the person or team maintaining the module.
If we receive a security bug report, we assign it to a primary handler. This person will coordinate the fix and release process, involving the following steps:
- Confirm the problem and determine the affected versions.
- Audit code to find any potentially similar problems.
- Roll out the fixes.
If you have suggestions on how to improve this process, please submit a pull request or reach out on Discord.