Security Policy

Reporting a Vulnerability

If you believe you have found a security vulnerability in TaskTide, please report it privately rather than opening a public issue.

While SAST tools like Dependabot and CodeQL are used to flag such events, and TaskTide makes every effort to appropriately act on them. These tools may not catch everything, and so TaskTide is grateful for insights provided here, and asks users to follow vulnerability reporting guidelines outlined here.

As GitHub has a feature to report a vulnerabilities described here. Users should please use that, as the tasktide.org domain is intentionally configured not to send or recieve emails, so there are no "[email protected]" or "[email protected]" email addresses.

In the advent private reporting is unavailable, contact the project maintainers privately before disclosing the vulnerability publicly.

Please include:

• A description of the vulnerability
• Steps to reproduce it, where possible
• The affected TaskTide version
• Any relevant logs, proof-of-concept code, or other technical details

We will acknowledge valid reports and work to assess and address the issue as appropriate.