Reporting a vulnerability

How to report a security problem privately, and which versions receive fixes.

Reporting a vulnerability

Report vulnerabilities privately through GitHub’s private vulnerability reporting on the wingsmith-dev/wingsmith repository: open the Security tab, then Report a vulnerability. Do not open a public issue, pull request or discussion for a security problem.

Include what you can of:

• the component and commit
• the configuration involved
• steps to reproduce
• what an attacker gains

A maintainer will acknowledge the report, keep you updated in the advisory thread, and credit you in the advisory unless you ask not to be.

Supported versions

Wingsmith is pre-release. There are no tagged releases yet, so only the main branch receives security fixes. Once releases exist, this section will say which ones are supported.

Security model

How Wingsmith authenticates callers, where it draws trust boundaries, and the known limitations are on Security. Read that page before you deploy.