Security Disclosures
The RGC team takes security seriously and thanks researchers and users who report vulnerabilities responsibly.
Supported versions
| Version | Support |
|---|---|
| 0.1.x | ✅ Security fixes accepted |
Pre-release and historical versions do not receive security fixes; please reproduce issues on the latest release.
How to report
Do not disclose security details publicly (issues, forum, activity feed). Report through GitHub's private security advisory, including where possible:
- affected versions and reproduction steps;
- proof-of-concept code or input samples;
- impact assessment (local privilege escalation, compile-time code execution, supply chain, etc.).
Process
- Acknowledgement: we confirm receipt and give an initial assessment within 7 days.
- Fix: we develop a fix and keep the reporter informed.
- Release: the fix ships with a patch release, together with a security advisory.
- Credit: we credit the reporter in the advisory unless they prefer to remain anonymous.
We will not take legal action against good-faith researchers.