Security fixes are provided for the latest version published on the GitHub Releases page. Older releases and unreleased source revisions are not supported. Before reporting a vulnerability, confirm it still affects the latest release when it is safe to do so.
Do not disclose suspected vulnerabilities in a public issue, discussion, pull request, or other public channel. Submit a private report through GitHub private vulnerability reporting. This repository does not require reporters to publish private contact details.
Include enough evidence for the maintainers to reproduce and assess the report:
- a description of the vulnerability and its security impact;
- the affected Buddy version, operating system, and architecture;
- reproducible steps or a minimal proof of concept;
- relevant logs, screenshots, or configuration with secrets and personal data removed; and
- any known mitigations or suggested remediation, if available.
The HemSoft repository owner and designated hs-buddy maintainers are responsible for triage. They will acknowledge a report within three business days and provide an initial status update within seven business days. If investigation continues, maintainers will provide an update at least every seven business days. Critical reports may receive an accelerated response. Resolution timing depends on severity, complexity, and release coordination.
Please keep the report and related details private while maintainers investigate and prepare a fix. HemSoft will work with the reporter to agree on a disclosure timeline, communicate mitigations and release plans, and publish a GitHub security advisory when appropriate. The advisory may request a CVE and credit the reporter unless the reporter prefers anonymity.
If the report is not a security vulnerability, maintainers may close the private report and direct follow-up to the appropriate public support channel. If a response window is missed, update the existing private report rather than opening a public issue so the original context remains available.