Thank you for taking the time to investigate the security of ORDO. The security of ORDO is our topmost priority. We appreciate investigative work into system security by well-intentioned, ethical security researchers. If you discover a vulnerability, however small, we would like to know about it to address it with appropriate measures as quickly as possible. This document outlines the method we use to work with the security research community to address runtime security.

Use this section to tell people about which versions of your project are currently being supported with security updates.

Please open a new Security advisory with your findings. We strive to resolve all problems as quickly as possible, and are more than happy to play an active role in publication of writeups after the problem is resolved.

Try to include as much information as possible in the initial report, so we can quickly address the issue.

Please do not open security issues in the public issue tracker.

• Do not take advantage of the vulnerability or problem you have discovered.
• Do not publish or reveal the problem until it has been resolved.
• Do not use attacks on physical security or applications of third parties.
• Do provide sufficient information to reproduce the problem, so we will be able to resolve it as quickly as possible. Usually, a list of steps to follow, and the vulnerable ORDO version is enough. More complex vulnerabilities may require further explanation.

• If you act in accordance with this policy, we will not take legal action against you in regard to your report.
• We will handle your report with strict confidentiality, and not pass on your personal details to third parties without your permission.

This document is based on Deno Security Policy.