Skip to content

SECURITY.md

Latest commit

 

History

History
39 lines (26 loc) · 1.13 KB

SECURITY.md

File metadata and controls

39 lines (26 loc) · 1.13 KB
Raw

Security Policy

Supported Versions

Version Supported
Latest ✅

All packages in this monorepo follow independent versioning. Security patches are applied to the latest version of each affected package.

Automated Security Scanning

Every pull request runs automated dependency-review (GitHub's dependency-review-action) and every release generates an SBOM via anchore/sbom-action. Run pnpm audit locally before opening a PR.

Reporting a Vulnerability

Do NOT open a public GitHub issue.

Email info@decentralchain.io with:

  1. Affected package(s) (e.g. @decentralchain/transactions)
  2. Description of the vulnerability
  3. Steps to reproduce
  4. Potential impact assessment
  5. Suggested fix (optional)

Timeline

  • Acknowledgement: 48 hours
  • Assessment: 5 business days
  • Critical patch: 14 days
  • Lower severity: 30 days

Best Practices

  • Use the latest supported version of each @decentralchain/* package
  • Pin dependencies with lockfiles (pnpm-lock.yaml)
  • Run pnpm audit regularly
  • Keep Node.js at version 24+ as required by this project