Security
Responsible disclosure
Confium takes security reports seriously. This page describes what's in scope, how to report, and the response you can expect.
How to report
Email security@confium.org with:
- A description of the issue and its impact.
- Steps to reproduce (code, commands, or test case).
- Affected versions, if known.
- Any suggested mitigations.
For sensitive material, encrypt to the project PGP key (keys.openpgp.org).
In scope
| Target | In scope? |
|---|---|
| Confium engine source (confium/confium) | Yes |
| Ruby bindings (confium/confium-ruby) | Yes |
| WASM verifier (confium/confium/crates/confium-wasm) | Yes |
| Public website (confium/confium.github.io) | Yes |
| Published packages on crates.io, RubyGems, npm | Yes |
| Third-party plugins (report to the plugin author) | No |
| Issues in your application code that consumes Confium | No |
| Vulnerabilities in dependencies (report upstream) | No |
Response timeline
- Within 48 hours: acknowledge receipt of the report.
- Within 7 days: initial assessment and severity rating.
- Within 90 days: coordinated disclosure timeline agreed with the reporter.
- At disclosure: publish a security advisory on GitHub Security Advisories and on this page; publish patched releases.
What we ask of reporters
- Give us reasonable time to fix before public disclosure.
- Do not access or modify data that isn't yours.
- Do not perform DoS, mass scanning, or social engineering against the project or its maintainers.
Bounty
Confium does not run a paid bounty program at this time. Significant contributions to security will be acknowledged publicly (with the reporter's consent) in the release notes.
Past advisories
Published advisories appear on GitHub Security Advisories.