Responsible Disclosure

[aleister1102]

Description

Hi,

I have submitted a report via GitHub advisory. It's been there for a month.

Can you review it?

Thanks!

Steps to reproduce

N/A

Environment

N/A

Logs / error output

[peterxing]

Opened a small PR that gives the project a private security intake path and public routing guidance: #1117

It adds a root SECURITY.md with GitHub private vulnerability reporting, advisory follow-up guidance, EmDash-specific scope examples for auth/admin/media/API/plugin sandboxing, coordinated disclosure, and safe-harbor boundaries. I kept it conservative/non-bounty-specific so maintainers can adapt it without accidentally promising reward terms.

If useful, I can also do a paid follow-up pass: A$390 for a security-policy readback against EmDash's actual maintainer flow/advisory backlog, or A$690 for a launch-ready security-program packet with severity rubric, response SLA, advisory template, and release-note checklist. Contact: info@transhumanism.com.au