Please report any security issue whatsoever in the @beartype ecosystem by privately submitting:
- A New draft security advisory – also accessible via the Advisories tab of the Security pane for this public GitHub repository.
Our gratitude is infinite. Open-source software improves the mutual security of humanity through openness, transparency, and many eyeballs. You are those eyeballs.
Despite the thrilling puns that even now bedevil our documentation, @beartype is a production-grade family of quality assurance (QA) devtooling leveraged by security-conscious governments, corporations, non-profits, and citizens the world over – including the United Kingdom's very own Government Communications Headquarters (GCHQ).
@beartype maintainers, developers, and users alike treat security concerns with the gravity they deserve. You care about security. So do we. Your concerns concern us. We humbly appreciate your efforts to responsibly disclose security vulnerabilities. In return, we will act swiftly to:
- Privately reply to your private disclosure with bald-faced panic. Just kidding! We'll inform you about what happens next. Some amount of panicking might be involved. Ideally, not much.
- Privately communicate with you during our resolution process. This is where the "fun" happens. We might request additional information, guidance, metadata, and spiritual support.
- Publicly publish a new stable release resolving these vulnerabilities.
- Publicly disclose the vulnerabilities you discovered, usually alongside
a new
Announcement
announcing the aforementioned new stable release in the Discussion
forums for this public
GitHub repository. Our public disclosure will document this vulnerability in
detail – including some or all of:
- Which @beartype features are affected.
- How @beartype users can strategically mitigate this vulnerability. The answer usually reduces to: "Update @beartype and pray for your safety!" We'll embellish this answer with animated memes that make the @beartype userbase superficially feel better about what actually is a deep tragedy.
- How you personally discovered this vulnerability.
- Publicly acknowledge your invaluable personal contributions.
Our gratitude intensifies. Your eyeballs continue to make the world a safer place. Bet you didn't know your eyeballs could do that, huh? Yet they did. When humanity is secured, quality is assured.