mirror of
https://github.com/axios/axios.git
synced 2026-04-11 02:11:50 +08:00
054c1f30fd
* ci: set hardened --ignore-scripts for all ci actions * docs: adds new docs platform * chore: remove un-needed ignore * chore: add sponsors data. adjust package.json to be of type module * fix: inconsistency between the docs and readme * fix: docs inconsistency * docs: update language and phrasing * style: fix issues with card styling * docs: update security.md with latest changes * docs: remove un-needed code * docs: fix inconsistencies with actual library function * ci: added deployment for docs * chore: added axios as dep for docs * docs: fix batch of errors * fix: bump esbuild as the version included is a risk
33 lines
1.9 KiB
Markdown
33 lines
1.9 KiB
Markdown
# Security Policy
|
||
|
||
## Supported Versions
|
||
|
||
The following versions will receive security updates promptly based on the maintainers' discretion.
|
||
|
||
| Version | Supported |
|
||
| ------- | ------------------ |
|
||
| 0.x.x | :white_check_mark: |
|
||
| 1.x.x | :white_check_mark: |
|
||
|
||
## Reporting a Vulnerability
|
||
|
||
If you believe you have found a security vulnerability in the project, please report it to us as described below. We take all security vulnerabilities seriously. If you have found a vulnerability in a third-party library, please report it to the maintainers of that library.
|
||
|
||
## Reporting Process
|
||
|
||
Please do not report security vulnerabilities through public GitHub issues. Please use the official security channel on GitHub by logging a [security advisory](https://github.com/axios/axios/security).
|
||
## Disclosure Policy
|
||
|
||
When we receive a security vulnerability report, we will assign it a primary handler. This person is responsible for the vulnerability report. The handler will confirm the problem and determine the affected versions. The handler will then evaluate the problem and determine the severity of the issue. The handler will develop a fix for the problem and prepare a release. The handler will notify the reporter when the fix is ready to be announced.
|
||
|
||
## Security Updates
|
||
|
||
Security updates will be released as soon as possible after the patch has been developed and tested. We will notify users of the release via the project’s GitHub repository. We will also publish the release notes and security advisories on the project’s GitHub releases page. We will also deprecate all versions that contain the security vulnerability.
|
||
|
||
## Security Partners and Acknowledgements
|
||
|
||
We would like to thank the following security researchers for working with us to help make the project safe for everyone:
|
||
|
||
- [Socket Dev](https://socket.dev/)
|
||
- [GitHub Security Lab](https://securitylab.github.com/)
|