Security policy

cra-kit helps manufacturers handle vulnerabilities, so it follows the same practice itself.

Reporting a vulnerability

Please report security issues privately, in either of these ways:

GitHub (preferred): Security → Report a vulnerability on this repository (https://github.com/dynamohtech/cra-kit/security/advisories/new).
Email: dynamohtech24@gmail.com, with "cra-kit security" in the subject.

Do not open a public issue for a security problem.

Please include the version (cra-kit --version), what you ran, and what an attacker could achieve.

An acknowledgement within 5 working days.
An assessment and a planned fix date as soon as the issue is confirmed.
A GitHub security advisory and a CVE, where appropriate, when the fix is released. You are credited unless you ask not to be.

Security fixes go into the latest release. cra-kit is pre-1.0, so please upgrade to the latest version.

cra-kit reads lockfiles as data and never executes project code. A way to make it execute code, write outside the paths you give it, or send data other than package URLs to OSV.dev is a vulnerability.
Wrong or missing advisories come from the upstream databases: report those to OSV.dev or the originating database.