---
title: "Security policy"
description: "How to report a vulnerability, the fix times we commit to and how CVEs are numbered."
section: "community"
status: "Planned for 0.5"
spec: "community-launch"
canonical: "https://mainsdk.dev/docs/community/security"
updated: "2026-10-28"
---

# Security policy

> How to report a vulnerability, the fix times we commit to and how CVEs are numbered.

Status: Planned for 0.5 · Canonical: https://mainsdk.dev/docs/community/security · Updated: 2026-10-28

MainSDK runs inside other people's apps, so we treat a vulnerability in it as a vulnerability in theirs. This policy says how to report one and what we promise in return.

## Report a vulnerability

Report privately through GitHub: open [Report a vulnerability](https://github.com/hubxero/mainsdk/security/advisories/new) on this repository (Security tab, then Advisories). Only the maintainers see it.

- Don't open a public issue, pull request or discussion for a vulnerability.
- Include the affected package and version, what an attacker can do, and the smallest reproduction you have.
- Please don't test against apps you don't own, or access other people's data.

We aim to acknowledge a report within 3 working days and to give you a severity rating (CVSS 4.0) when triage ends.

## Fix times

Clocks start when we confirm the issue.

| Severity | Fixed and released within |
| --- | --- |
| Critical | 7 days |
| High | 30 days |
| Medium and low | the next planned release |

Every fixed issue of any severity gets a GitHub security advisory.

## CVE numbering

We request CVE IDs through GitHub Security Advisories, with GitHub as the CVE Numbering Authority, and publish the CVE in the advisory.

## Disclosure

We follow coordinated disclosure. We publish the advisory when the fix is released, and within 90 days of your report at the latest, unless we agree a different date with you. We credit you in the advisory unless you ask us not to.

## Supported versions

No MainSDK package is published yet. Once packages are published:

| Version | Security fixes |
| --- | --- |
| Latest 0.x minor | Yes, until 1.0 |
| Older 0.x minors | No; upgrade to the latest minor |
| 1.x (from 1.0) | Yes |

**Long-term support:** 1.0 opens the first long-term support line, which gets security fixes for at least 24 months after 1.0 ships. Each baseline (Main 27 first) names the long-term support line it is supported on.

## Bug bounty

A bug bounty goes live at public beta (milestone 0.5). Its scope, reward table and safe-harbour statement are published on the [bounty page](https://mainsdk.dev/docs/community/bounty.html) before it opens. Until it opens, we can't pay rewards, and we thank reporters in the advisory.

## Scope

In scope: the packages in this repository (`mainsdk`, `@mainsdk/cli`, `@mainsdk/core`, `@mainsdk/testing`), their release artifacts and signatures, and the release workflow. Out of scope: apps built with MainSDK (report to their owners) and third-party drivers published by their authors.


## Bug bounty

Scope, rewards and safe harbour for the bounty are on the [bounty page](bounty.md).