Soplang Security Policy

Do not report security vulnerabilities through public GitHub issues or community forums.

Please report security vulnerabilities by emailing our security team at: security@soplang.org

Please include the following information in your report:

• Type of vulnerability
• Path or location of the vulnerable code
• Step-by-step instructions to reproduce the issue
• Explanation of potential impacts
• Suggested fix, if available

Our security team will acknowledge your email within 48 hours, and you'll receive a more detailed response within 72 hours indicating the next steps in handling your report.

When we receive a security vulnerability report, we will:

1. Confirm the vulnerability and determine its scope
2. Develop and test a fix
3. Prepare an update that addresses the vulnerability
4. Release the update and credit the reporter (unless they prefer to remain anonymous)

We ask that you give us reasonable time to address the vulnerability before any public disclosure. We typically address critical issues within 7-14 days.

To keep your Soplang projects secure:

• Keep Soplang and its dependencies updated to the latest versions
• Follow secure coding practices, especially when handling user input
• Regularly review and update your dependencies
• Be cautious when running untrusted Soplang code
• Use dependency scanning tools to identify vulnerabilities