083a46e93b
Some checks failed
Verify / Install node dependencies (push) Failing after 2s
Verify / Build packages (push) Has been skipped
Verify / Check linting & formatting (push) Has been skipped
Verify / Run unit tests (push) Has been skipped
Verify / Run e2e tests (shard 1/4) (push) Has been skipped
Verify / Run e2e tests (shard 2/4) (push) Has been skipped
Verify / Run e2e tests (shard 3/4) (push) Has been skipped
Verify / Run e2e tests (shard 4/4) (push) Has been skipped
Publish / Resolve publish config (push) Failing after 2s
Publish / Send notification to Slack (push) Has been skipped
Publish / Send failure notification to Slack (push) Failing after 8s
Verify / Merge e2e reports (push) Has been skipped
Publish / Build (push) Has been skipped
Publish / Bump Versions OR Release to Registry (push) Has been skipped
33 lines
1.3 KiB
Markdown
33 lines
1.3 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting Vulnerabilities
|
|
|
|
If you discover a security vulnerability in Tiptap, please report it responsibly. We appreciate your help in keeping our users safe.
|
|
|
|
### How to Report
|
|
|
|
**Please do not report security vulnerabilities through public GitHub issues.**
|
|
|
|
Send details to security@tiptap.dev. Include a description of the vulnerability, steps to reproduce, and any potential impact.
|
|
|
|
We will acknowledge receipt within 48 hours and provide updates as we investigate.
|
|
|
|
## Response Process
|
|
|
|
Vulnerabilities are assessed and prioritized based on severity, exploitability, and business impact. Fixes are deployed according to the following timelines:
|
|
|
|
- **Critical** (e.g., remote code execution, data breaches): Fixed and released within 24 hours.
|
|
- **High** (e.g., significant data exposure): Fixed and released within 72 hours.
|
|
- **Medium** (e.g., moderate leaks): Fixed and released within 14 days.
|
|
- **Low** (e.g., minor issues): Addressed in the next scheduled update.
|
|
|
|
We follow responsible disclosure practices and will credit reporters unless requested otherwise.
|
|
|
|
## Scope
|
|
|
|
This policy applies to all Tiptap packages and related infrastructure. Reports are handled through our established vulnerability management process.
|
|
|
|
## Contact
|
|
|
|
For questions, email security@tiptap.dev or humans@tiptap.dev.
|