OpenFrame/SECURITY.md

Security Policy

Supported Versions

OpenFrame is under active development. Security fixes are prioritized for the latest code on master and recent release tags (if available).

Reporting a Vulnerability

Please do not report security vulnerabilities in public issues. Report vulnerabilities by email to [email protected].

Include as much detail as possible:

• Affected area (API route, auth flow, upload flow, etc.)
• Reproduction steps
• Proof of concept (if available)
• Potential impact
• Suggested remediation (optional)

What to Expect

After a private report is submitted:

1. Maintainers acknowledge receipt.
2. Impact and exploitability are triaged.
3. A fix is prepared and validated.
4. Disclosure timing is coordinated.
5. Credits are given when appropriate.