We take security very seriously at SDA SE. We welcome any review of the latest release of all our open source code to ensure that these components can not be compromised. In case you identified a security related issue with severity of low to medium, please create a GitHub issue.
In case you identified a security related issue with severity of high or critical, please
disclose information about the issue non-public via email to opensource-security@sda.se.
We encourage researchers to include a Proof-of-Concept, supported by screenshots or videos. For each given security related issue with severity high or critical (based on SDA SE own assessment), we will respond within one week.
There is no format in commits to identify security related fixes. It is not planned yet.
We perform daily vulnerability scans to be informed about known vulnerabilities. We perform a vulnerability assessment as soon as possible and perform actions based on the outcome.