Security
How to report a vulnerability, what happens next, and how fast. No bounty programme — said plainly rather than left to guess.
Pre-launch draft: written, not reviewed by a lawyer.
Reporting
Write to security@granularity.tech privately. Please do not open a public issue for a vulnerability — a public report is a public exploit until the fix ships.
Useful in a report: what is affected and at which version, how to reproduce it, what an attacker gains, and how you would like to be credited. A rough report sent early beats a polished one sent late.
This page is the policy referenced by
/.well-known/security.txt.
What happens next
| Step | Commitment |
|---|---|
| Acknowledgement | Within 72 hours |
| Assessment of severity | With the acknowledgement or shortly after |
| Fix and release | Out of band — security fixes do not wait for the next planned release |
| Backport | To the previous major, within its support window |
| Advisory | A GitHub Security Advisory, with a CVE where one applies |
| Credit | Your name in the advisory, unless you would rather not be named |
Security fixes ship out of order on purpose. A fix that waits for a release train is a known vulnerability with a schedule attached.
There is no bounty
We do not pay for reports. This is said here rather than left to be discovered, because finding out after the work is done is worse than knowing before it starts.
Scope
In scope: the granularity.tech site and the published @feugene/granularity* packages.
Out of scope: findings that require a compromised device or browser; reports produced by a scanner with no demonstrated impact; missing hardening headers with no exploit path; and denial of service against the hosting provider.
What this site is, from a security point of view
Static files. No server-side code, no database, no accounts, no session, no user input that reaches a server. Nothing is stored about visitors — see Privacy and Cookies.
That does not make it uninteresting: the supply chain behind the build, the published packages, and the domain itself all matter, and reports about them are welcome.
Please do not
Test with load or denial of service, access data that is not yours, or make changes to anything. Report it instead — the account of what you could have done is exactly as useful, and does no harm.