This policy covers every TelemetryWorks repository that does not carry its
own SECURITY.md.
Please report suspected vulnerabilities privately, through GitHub's private vulnerability reporting:
- Open the affected repository on GitHub.
- Go to Security → Advisories → Report a vulnerability.
- Describe the problem there. Only the maintainers can see the report.
Please do not open a public issue, pull request, or discussion about a security problem.
When you can:
- a description of the vulnerability and its potential impact;
- the affected repository, crate, and versions;
- the input or steps that reproduce it (for these projects often a small file or byte sequence);
- a proof of concept, if you have one.
- We aim to acknowledge a report within 7 days.
- We ask for at least 30 days to fix a confirmed problem before it is disclosed publicly, and we will agree the details of publication with you once a fix is available.
- We credit reporters who want to be credited.
- We will not pursue legal action against good-faith security research.
Security fixes go into:
- the most recent release of each crate or tool, and
- the default branch.
Older releases are fixed on a best-effort basis, depending on severity.
- Assess its severity and scope.
- Develop and test a fix or mitigation, keeping the reporter informed.
- Release fixed versions.
- Publish a GitHub security advisory, with a CVE where appropriate.
Each repository states its own practices in its documentation. For the
IRIG 106 crates (irig106-*) they are:
| Practice | Status |
|---|---|
No unsafe code |
required |
| Formatting, Clippy with warnings as errors, and tests on every change | in place in irig106-tmats and irig106-time |
Dependency policy checked by cargo deny (known vulnerabilities, unmaintained or yanked crates, licences, sources) |
in place in irig106-tmats and irig106-time |
Clippy lints against unwrap, expect, panics, and printing in library code |
planned, with the rebuilt libraries |
| Tests on Windows, Linux, and macOS | in place in irig106-tmats and irig106-time |
| Minimum test coverage | planned |
| Fuzzing of parsers | planned for the rebuilt libraries (irig106-time has fuzz harnesses from its prototype, not yet run in CI) |
| Software bill of materials and build-provenance attestation for released binaries | planned, with the first releases of binaries |
| Publishing to crates.io from GitHub Actions only, through trusted publishing (no stored tokens) | planned, with the first releases |
Released binaries will be verifiable with
gh attestation verify <file> --owner TelemetryWorks once attestations are
in place.