ad2c14b985
Answer the OpenSSF Best Practices criteria that asked for policies the project follows but had not written down: - SECURITY.md: a first response within 14 days, publishing an advisory with credit once a fix is released, and that only the latest release receives security fixes. - Governance: who has access to the project's resources, how write or admin access is granted, and how CI secrets are stored and rotated. - Quality assurance: how dependencies of the build, test, and documentation tooling are pinned, scanned, and kept free of known vulnerabilities. Also update the assurance case, since comparison no longer recurses per nesting level (#5390), and point the best practices badge and links to bestpractices.dev under the program's current name. Signed-off-by: Niels Lohmann <mail@nlohmann.me>
2.3 KiB
Security Policy
Reporting a Vulnerability
We value the security of our users and appreciate your efforts to responsibly disclose vulnerabilities. If you have identified a security vulnerability in this repository, please use the GitHub Security Advisory "Report a Vulnerability" tab.
Until it is published, this draft security advisory will only be visible to the maintainers of this project. Other users and teams may be added once the advisory is created.
We will send a first response within 14 days, indicating the next steps in handling your report. After the initial reply to your report, we will keep you informed of the progress towards a fix and full announcement and may ask for additional information or guidance.
For vulnerabilities in third-party dependencies or modules, please report them directly to the respective maintainers.
Disclosure and credit
Once a fix is released, we publish the security advisory and list the fixed vulnerability in the release notes. We credit the reporter in both, unless they ask not to be named.
Supported versions
Security fixes are made on the develop branch and shipped with the next release. Only the latest release receives
security fixes; they are not backported to older releases. A release stops receiving security fixes when the next
release is published, so please update to the latest release to get them.
Unofficial packages
This project does not publish an official npm package. The npm package
nlohmann-json (or similarly named packages) is not maintained or
endorsed by this project. See the
package managers documentation for supported
integration options.
Additional Resources
- Explore security-related topics and contribute to tools and projects through GitHub Security Lab.
- Learn more about responsible disclosure and reporting vulnerabilities in GitHub at About coordinated disclosure of security vulnerabilities.
We sincerely thank you for contributing to the security and integrity of this project!