Security policy
How to report a vulnerability, the fix times we commit to and how CVEs are numbered.
Status Status is where the work is: Planned (in a milestone, not started), Building (tickets in progress), Preview (usable, may change), then the stability it ships at.
Stability The promise an interface ships with.
- Stable Follows semantic versioning; breaking changes need a new major, 12 months of overlap and a codemod.
- Beta Usable in production; may change before it becomes stable.
- Experimental May change or go away; needs an explicit opt-in in main.yaml.
MainSDK runs inside other people's apps, so we treat a vulnerability in it as a vulnerability in theirs. This policy says how to report one and what we promise in return.
Report a vulnerability
Report privately through GitHub: open Report a vulnerability on this repository (Security tab, then Advisories). Only the maintainers see it.
- Don't open a public issue, pull request or discussion for a vulnerability.
- Include the affected package and version, what an attacker can do, and the smallest reproduction you have.
- Please don't test against apps you don't own, or access other people's data.
We aim to acknowledge a report within 3 working days and to give you a severity rating (CVSS 4.0) when triage ends.
Fix times
Clocks start when we confirm the issue.
| Severity | Fixed and released within |
|---|---|
| Critical | 7 days |
| High | 30 days |
| Medium and low | the next planned release |
Every fixed issue of any severity gets a GitHub security advisory.
CVE numbering
We request CVE IDs through GitHub Security Advisories, with GitHub as the CVE Numbering Authority, and publish the CVE in the advisory.
Disclosure
We follow coordinated disclosure. We publish the advisory when the fix is released, and within 90 days of your report at the latest, unless we agree a different date with you. We credit you in the advisory unless you ask us not to.
Supported versions
No MainSDK package is published yet. Once packages are published:
| Version | Security fixes |
|---|---|
| Latest 0.x minor | Yes, until 1.0 |
| Older 0.x minors | No; upgrade to the latest minor |
| 1.x (from 1.0) | Yes |
Long-term support: 1.0 opens the first long-term support line, which gets security fixes for at least 24 months after 1.0 ships. Each baseline (Main 27 first) names the long-term support line it is supported on.
Bug bounty
A bug bounty goes live at public beta (milestone 0.5). Its scope, reward table and safe-harbour statement are published on the bounty page before it opens. Until it opens, we can't pay rewards, and we thank reporters in the advisory.
Scope
In scope: the packages in this repository (mainsdk, @mainsdk/cli, @mainsdk/core, @mainsdk/testing), their release artifacts and signatures, and the release workflow. Out of scope: apps built with MainSDK (report to their owners) and third-party drivers published by their authors.
Bug bounty
Scope, rewards and safe harbour for the bounty are on the bounty page.
Was this page helpful?