https://sourceforge.net/p/sucrose/wiki/Security%2520Policy/Recent changes to Security PolicyenSat, 04 Jul 2026 04:15:34 -0000https://sourceforge.net/p/sucrose/wiki/Security%2520Policy/<div class="markdown_content"><h1 id="h-security-policy">Security Policy</h1> <p><em>Audience: users, researchers, contributors.</em> This page describes how to report a security vulnerability in Sucrose responsibly. The project follows <strong>coordinated (responsible) disclosure</strong>: report privately by email, do <strong>not</strong> disclose publicly until a fix has shipped, and the team keeps your report confidential. The authoritative source is <code>.github/SECURITY.md</code>.</p> <h2 id="h-contents">Contents</h2> <ul> <li><a href="#how-to-report-a-vulnerability">How to report a vulnerability</a></li> <li><a href="#what-to-include-in-your-report">What to include in your report</a></li> <li><a href="#disclosure-policy">Disclosure policy</a></li> <li><a href="#what-not-to-do">What not to do</a></li> <li><a href="#related-privacy--telemetry-notes">Related privacy &amp; telemetry notes</a></li> <li><a href="#see-also">See also</a></li> </ul> <hr/> <h2 id="h-how-to-report-a-vulnerability">How to report a vulnerability</h2> <p>Report security issues <strong>privately by email</strong> to:</p> <blockquote> <p><strong><code>taiizor@vegalya.com</code></strong></p> </blockquote> <p>Do <strong>not</strong> open a public GitHub issue, pull request, or Discussion for a security vulnerability — public disclosure before a fix is available puts users at risk. Email is the dedicated, confidential channel for security reports.</p> <hr/> <h2 id="h-what-to-include-in-your-report">What to include in your report</h2> <p>To help the maintainer reproduce and fix the issue quickly, include:</p> <ul> <li>A <strong>descriptive subject line</strong> identifying it as a security report.</li> <li>The <strong>affected file and line</strong> (optional, but helpful).</li> <li><strong>Exploit details</strong> — how the vulnerability can be triggered and what its impact is.</li> <li>Your <strong>name or alias</strong> for acknowledgment (optional).</li> </ul> <hr/> <h2 id="h-disclosure-policy">Disclosure policy</h2> <ul> <li><strong>Confidentiality.</strong> The team keeps all security reports confidential while a fix is being prepared.</li> <li><strong>Coordinated disclosure.</strong> Please do <strong>not</strong> disclose the issue publicly until it has been fixed.</li> <li><strong>Announcement after the fix.</strong> The team announces the vulnerability <strong>after the fix ships in a new version</strong>, so users have a patched release available before details are public.</li> </ul> <p>Sucrose uses a date-based version scheme (<code>yy.MM.dd(.0)</code>); a security fix is delivered as a normal new release through the usual channels (see <a href="./Updating-Sucrose">Updating Sucrose</a> and <a href="/p/sucrose/wiki/Installation/">Installation</a>).</p> <hr/> <h2 id="h-what-not-to-do">What not to do</h2> <ul> <li><strong>Do not</strong> file a public issue, PR, or Discussion describing the vulnerability.</li> <li><strong>Do not</strong> publish proof-of-concept exploits, write-ups, or details before the fix is released.</li> <li><strong>Do not</strong> test against other users' machines or any infrastructure you do not own.</li> </ul> <hr/> <h2 id="h-related-privacy-telemetry-notes">Related privacy &amp; telemetry notes</h2> <p>Security and privacy are tracked separately. Sucrose's optional, opt-in telemetry and crash-reporting behavior — what is collected, where it is sent, and how to disable it — is documented on <a href="./Privacy-Telemetry">Privacy &amp; Telemetry</a>. One item of note covered there: the optional <code>PersonalAccessToken</code> setting is stored in plaintext JSON under <code>%AppData%\Sucrose\</code>. That is a privacy/handling note rather than a reported vulnerability; treat the token like any other secret.</p> <p>For general support that is <strong>not</strong> security-sensitive, use the public channels in <a href="./Getting-Help">Getting Help</a>.</p> <hr/> <h2 id="h-see-also">See also</h2> <ul> <li><a href="./Privacy-Telemetry">Privacy &amp; Telemetry</a></li> <li><a href="/p/sucrose/wiki/Contributing/">Contributing</a></li> <li><a href="./Getting-Help">Getting Help</a></li> <li><a href="./Updating-Sucrose">Updating Sucrose</a></li> <li><a href="./Crash-Reporting">Crash Reporting</a></li> </ul></div>Bayram EmekliSat, 04 Jul 2026 04:15:34 -0000https://sourceforge.net90df8b08a0aea3c995f814f8b5223bfa63a1d608