Thanks for helping keep Podium and its users safe.
Podium is in early development; there are no tagged releases yet. Once releases begin, this section will list which versions receive fixes.
Please do not file public issues for suspected vulnerabilities. Public issues can expose users before a fix ships.
Report privately using either of the following:
- GitHub private vulnerability reporting at https://github.com/lennylabs/podium/security/advisories/new (preferred).
Please include:
- A description of the issue and the impact you believe it has.
- Steps to reproduce, or a proof-of-concept.
- The commit, version, or branch you tested against.
- Any suggested mitigations you have in mind.
- Acknowledgement within 72 hours of your report.
- Initial assessment within 7 days (severity, scope, whether we can reproduce).
- Remediation plan communicated back to you once assessed.
- Fix and disclosure coordinated with you. We aim to ship a fix within 90 days of the initial report for most issues; we will keep you informed if we need longer.
We follow coordinated disclosure. We ask that you give us a reasonable window to ship a fix before publishing details. In return:
- We will credit you in the advisory if you would like to be credited.
- We will not pursue legal action against researchers acting in good faith under this policy.
Security research makes the whole ecosystem better. We appreciate the time and care that goes into a responsible report.