mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-24 20:20:10 +01:00
35 lines
1.3 KiB
Markdown
35 lines
1.3 KiB
Markdown
# Security policy
|
|
|
|
<!--
|
|
Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
Exceptions. See /LICENSE for license information.
|
|
SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
-->
|
|
|
|
It's important to us that the Carbon Language provides a secure implementation.
|
|
Thank you for taking the time to report vulnerabilities.
|
|
|
|
The Carbon Language is still an
|
|
[experimental project](/README.md#project-status), so please be careful if using
|
|
it in security-sensitive environments.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please use
|
|
<https://github.com/carbon-language/carbon-lang/security/advisories/new> to
|
|
report security vulnerabilities.
|
|
|
|
We use GitHub's vulnerability reporting for intake. We will respond to reports
|
|
within two weeks. For valid issues we will coordinate and disclose on GitHub.
|
|
|
|
If you haven't received a response, a couple steps to take are (in order):
|
|
|
|
1. Contact individuals directly:
|
|
- [Chandler Carruth](mailto:chandlerc@gmail.com)
|
|
- [Richard Smith](mailto:richard@metafoo.co.uk)
|
|
2. Reach out on
|
|
[#infra](https://discord.com/channels/655572317891461132/707150492370862090)
|
|
on Discord ([invite](https://discord.gg/ZjVdShJDAs))
|
|
- This is a public forum, so say you're asking for a security contact
|
|
rather than talking about the security issue directly.
|