From 1abb0b5a2d06e13158dfad6e2a11738cfc5a6816 Mon Sep 17 00:00:00 2001 From: Christof Lauriers Date: Sun, 22 Mar 2026 17:09:48 +0100 Subject: [PATCH] Add SECURITY.md with vulnerability reporting policy Co-Authored-By: Claude Sonnet 4.6 --- SECURITY.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..0786369 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,26 @@ +# Security Policy + +## Supported Versions + +Only the latest version on `master` is actively maintained. + +## Reporting a Vulnerability + +Please **do not** open a public GitHub issue for security vulnerabilities. + +Report them privately via GitHub's [Security Advisories](https://github.com/TheCraftyMaker/ModelPublisher/security/advisories/new). + +Include: +- A description of the vulnerability +- Steps to reproduce +- Potential impact + +You can expect an acknowledgement within a few days. If confirmed, a fix will be prioritised and you'll be credited in the release notes. + +## Scope + +This is a local CLI tool — it runs entirely on your own machine and communicates only with the platforms you explicitly publish to (Printables, MakerWorld, etc.). It stores no credentials itself; authentication is handled via persistent browser profiles on your local filesystem. + +The main areas of concern would be: +- Path traversal via a malicious `manifest.json` +- Arbitrary code execution via a crafted manifest