mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-24 20:20:10 +01:00
Jon Ross-PerkinsandChandler Carruth
b6396e97f8
Demo site: https://jonmeow.carbon-lang.dev/ I'm trying to keep work under the `/website` subdirectory so that the misc files don't interfere with unrelated views of the repository. The `prebuild.py` script does some work to move things around and add frontmatter, helping the jekyll generation. I'm using the "just-the-docs" theme because I think it's a decent match for what we want, and getting jekyll up and running with it wasn't too difficult. Note #1526 proposed using Docusaurus; I started out there, but was having trouble getting it working with newer versions. The plugins in particular I got stuck trying to make work, which sent me looking for options that we could have working with less customization. I do lean towards jekyll though, because it's what GH uses so hopefully we can get a more consistent experience. Having a website has been approved for a while under #1492, but hasn't been a priority. I'm mainly doing this because I want to just be able to point people to carbon-lang.dev and have easy links that way. --------- Co-authored-by: Chandler Carruth <chandlerc@gmail.com>
36 lines
1.3 KiB
Markdown
36 lines
1.3 KiB
Markdown
# Security policy
|
|
|
|
<!--
|
|
Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
Exceptions. See /LICENSE for license information.
|
|
SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
-->
|
|
|
|
It's important to us that the Carbon Language provides a secure implementation.
|
|
Thank you for taking the time to report vulnerabilities.
|
|
|
|
The Carbon Language is still an
|
|
[experimental project](/README.md#project-status), so please be careful if using
|
|
it in security-sensitive environments.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please use
|
|
<https://github.com/carbon-language/carbon-lang/security/advisories/new> to
|
|
report security vulnerabilities.
|
|
|
|
We use GitHub's vulnerability reporting for intake. We will respond to reports
|
|
within two weeks. For valid issues we will coordinate and disclose on GitHub.
|
|
|
|
If you haven't received a response, a couple steps to take are (in order):
|
|
|
|
1. Contact individuals directly:
|
|
- [Chandler Carruth](mailto:chandlerc@gmail.com)
|
|
- [Richard Smith](mailto:richard@metafoo.co.uk)
|
|
- [Jon Ross-Perkins](mailto:jperkins@google.com)
|
|
2. Reach out on
|
|
[#infra](https://discord.com/channels/655572317891461132/707150492370862090)
|
|
on Discord ([invite](https://discord.gg/ZjVdShJDAs))
|
|
- This is a public forum, so say you're asking for a security contact
|
|
rather than talking about the security issue directly.
|