This document explains how Deptrac security issues are handled by the maintainers.

If you think you have found a security issue in Deptrac, we ask you not to use the bug tracker and to not publish it publicly. Instead, all security issues must be sent to security@qossmic.com.

Deptrac is an Open-Source project where most of the work is done by volunteers. We appreciate that developers are trying to find security issues in Deptrac and report them responsibly, but we are currently unable to pay bug bounties.

In case of an incident being reported, we will...

1. try to confirm the vulnerability.
2. send an acknowledgement to the reporter, if the issue is confirmed
3. start working on a patch
4. prepare a security advisory to be published with the patch
5. send the patch and advisory to the reporter for review
6. apply the patch to all supported versions of Deptrac
7. release a new version of Deptrac with the applied patch
8. publish the advisory