Skip to content

Repository navigation

Security: firoorg/firo

Security

SECURITY.md

Security Policy

Reporting a vulnerability

Firo's primary security contact is Reuben Yap at reuben@firo.org.

Send vulnerability reports privately by PGP-encrypted email to that address. Do not post vulnerability details in public GitHub issues, pull requests, or discussions.

  • Public key: reuben.asc
  • PGP fingerprint: 0186454D63E83D85EF91DE4E1290A1D0FA7EE109

Scope and submission requirements

See the Firo Vulnerability Bounty Program for the current scope, submission requirements, severity criteria, disclosure guidelines, and bounty eligibility.

Reports should reproduce against the master branch of this repository and include the exact commit hash, affected files and line numbers, a working proof of concept, expected versus observed behavior, and demonstrated impact. Disclose any AI assistance as required by the program's submission policy.

There aren't any published security advisories