EventCatalog Ltd takes the security of the EventCatalog generators and their users seriously. We welcome reports from security researchers and users, and we are committed to working with you to understand and resolve issues quickly.
Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.
GitHub private vulnerability reporting is the only channel. Use this repository's Security tab, then "Report a vulnerability":
Please include as much of the following as you can:
- The affected package(s) and version(s)
- A description of the issue and its potential impact
- Steps to reproduce, or a proof of concept
- Any suggested mitigation
We aim to acknowledge your report within 3 business days. We will keep you updated, coordinate disclosure once a fix is released, and credit you unless you prefer to remain anonymous.
Each generator package under packages/ is versioned independently. Security fixes are released for the latest release of each package. We recommend always running the latest release.
This policy covers the EventCatalog generator packages in this repository published to npm under the @eventcatalog scope.
We will not pursue legal action against anyone who reports a vulnerability in good faith under this policy, provided they avoid privacy violations, data destruction and service disruption, and give us reasonable time to fix the issue before any public disclosure.