Skip to content

Security Policy

Reauth is an early-stage project with no stable API yet. Security fixes may introduce breaking changes: security takes priority over backward compatibility.

Supported versions

Security fixes target the latest release only. Older releases do not receive guaranteed backports; users should upgrade to the latest release to receive fixes.

Reporting a vulnerability

Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue or pull request disclosing a vulnerability.

Include as much of the following as possible:

  • The affected Reauth version and relevant environment details.
  • A description of the vulnerability and its potential impact.
  • Steps to reproduce it or a minimal proof of concept.
  • Any suggested mitigation or fix.

Use test data and remove real credentials, tokens, secrets, and personal data from reports and examples. If you are unsure whether an issue is a vulnerability, please use the private reporting channel anyway.

Handling reports

Maintainers will use the private advisory to discuss the report, assess its impact, and coordinate a fix and disclosure. Please keep vulnerability details private while we work together on remediation and agree on disclosure timing.

As a young project, we cannot guarantee response or resolution deadlines.