Only the latest release of Penelope is actively supported with security updates.
| Version | Supported |
|---|---|
| Latest release | ✅ |
| Previous releases | ❌ |
Please do not open a public GitHub issue for suspected security vulnerabilities.
The preferred way to report a vulnerability is through GitHub's private vulnerability reporting feature:
Security → Advisories → Report a vulnerability
Alternatively, you can contact us at:
Please include as much relevant information as possible, such as:
- A description of the vulnerability
- Affected version(s)
- Steps to reproduce
- Proof of concept, if available
- Potential security impact
- Suggested fix, if available
We aim to acknowledge security reports within 72 hours.
If the issue is confirmed, we will coordinate remediation and disclosure with the reporter.
Confirmed vulnerabilities may be published as a GitHub Security Advisory and assigned or requested a CVE when appropriate.
Penelope interacts with potentially hostile systems by design.
Some behaviors that may appear security-sensitive are inherent to its operation or are documented risks rather than vulnerabilities.
For known security characteristics, trust assumptions, and operational risks, please review the Security considerations section of the README before submitting a report.
Please allow reasonable time for a vulnerability to be investigated and fixed before publicly disclosing technical details.
We appreciate responsible disclosure and will credit reporters in the corresponding security advisory unless they prefer to remain anonymous.