Files
carbon-lang/SECURITY.md
T
Jon Ross-PerkinsandChandler Carruth b6396e97f8 Build a website. (#4189)
Demo site: https://jonmeow.carbon-lang.dev/

I'm trying to keep work under the `/website` subdirectory so that the
misc files don't interfere with unrelated views of the repository. The
`prebuild.py` script does some work to move things around and add
frontmatter, helping the jekyll generation.

I'm using the "just-the-docs" theme because I think it's a decent match
for what we want, and getting jekyll up and running with it wasn't too
difficult. Note #1526 proposed using Docusaurus; I started out there,
but was having trouble getting it working with newer versions. The
plugins in particular I got stuck trying to make work, which sent me
looking for options that we could have working with less customization.
I do lean towards jekyll though, because it's what GH uses so hopefully
we can get a more consistent experience.

Having a website has been approved for a while under #1492, but hasn't
been a priority. I'm mainly doing this because I want to just be able to
point people to carbon-lang.dev and have easy links that way.

---------

Co-authored-by: Chandler Carruth <chandlerc@gmail.com>
2024-08-20 17:53:06 +00:00

1.3 KiB

Security policy

It's important to us that the Carbon Language provides a secure implementation. Thank you for taking the time to report vulnerabilities.

The Carbon Language is still an experimental project, so please be careful if using it in security-sensitive environments.

Reporting a vulnerability

Please use https://github.com/carbon-language/carbon-lang/security/advisories/new to report security vulnerabilities.

We use GitHub's vulnerability reporting for intake. We will respond to reports within two weeks. For valid issues we will coordinate and disclose on GitHub.

If you haven't received a response, a couple steps to take are (in order):

  1. Contact individuals directly:
  2. Reach out on #infra on Discord (invite)
    • This is a public forum, so say you're asking for a security contact rather than talking about the security issue directly.