We take security seriously. This section outlines which versions of our project are currently supported with security updates.

If you discover a security vulnerability in this project, please report it responsibly. We appreciate your help in keeping our users safe.

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report security vulnerabilities by emailing:

• Email: krishna@krishnabajpai.me
• Subject: [SECURITY] Vulnerability Report - SubMicro Execution Engine

When reporting a vulnerability, please include:

1. Description: A clear description of the vulnerability
2. Impact: What an attacker could achieve by exploiting this vulnerability
3. Steps to Reproduce: Detailed steps to reproduce the issue
4. Proof of Concept: If possible, include a proof of concept
5. Environment: Your testing environment (OS, versions, etc.)
6. Suggested Fix: If you have suggestions for fixing the issue

1. Acknowledgment: We will acknowledge receipt of your report within 48 hours
2. Investigation: We will investigate the report and determine its validity
3. Updates: We will provide regular updates on our progress (at least weekly)
4. Fix Development: If valid, we will develop and test a fix
5. Disclosure: We will coordinate disclosure with you

• We follow responsible disclosure practices
• We will credit you (if desired) in our security advisory
• We aim to release fixes as quickly as possible
• We will not disclose vulnerability details until a fix is available

This security policy applies to:

• The SubMicro Execution Engine core codebase
• Official documentation
• Official build scripts and tooling

This policy does not apply to:

• Third-party dependencies (report to the respective projects)
• Configuration issues in user environments
• Denial of service attacks that require unrealistic resource usage
• Issues in development/unreleased code

We consider security research conducted in accordance with this policy to be authorized research. We will not pursue legal action against researchers who follow this policy.

Security updates will be released as patch versions with the following naming convention:

• MAJOR.MINOR.PATCH where PATCH indicates a security fix

Security advisories will be published on:

• GitHub Security Advisories
• Our changelog and release notes

For security-related questions or concerns:

• Email: krishna@krishnabajpai.me
• PGP Key: Available upon request

Thank you for helping keep the SubMicro Execution Engine secure!