Security policy¶
The canonical security policy ships in the repository root as
SECURITY.md
so that GitHub auto-detects it and surfaces the
Security → Report a vulnerability button.
Reporting a vulnerability¶
Use one of these channels:
- GitHub Private Vulnerability Reporting — on the repository page, Security → Report a vulnerability, or open the direct link.
- Email —
sen.serafim.dev2gmail.comwith subject prefix[yt-uniquifier security].
Please do not open a public issue for a suspected vulnerability.
Response timeline¶
| Severity | Acknowledge | Fix shipped |
|---|---|---|
| CRITICAL | within 1 business day | within 14 calendar days |
| HIGH | within 3 business days | within 30 calendar days |
| MEDIUM | within 5 business days | within 60 calendar days |
| LOW | best-effort | next MINOR release |
Supported versions¶
Security fixes land on the most recent MAJOR.MINOR line.
| Version | Security fixes |
|---|---|
| 1.3.x | ✅ active |
| 1.2.x and earlier | ❌ end-of-life |
See the full policy — scope, disclosure timeline, hall of fame —
in SECURITY.md.
For the SemVer commitment and how breaking changes are proposed, see Versioning.