MonoNeural is actively maintained and security updates are currently provided only for the latest stable version of the project.
Only the most recent version receives security-related fixes and updates. Users are encouraged to keep their local environments and deployments up to date.
The security and reliability of MonoNeural are taken seriously. If you discover a potential security issue, vulnerability, or behavior that could affect the safety of users or the integrity of the project, please report it responsibly.
Please do not create public GitHub issues for security vulnerabilities.
Instead, report security concerns through one of the following methods:
- Open a GitHub Security Advisory if available
- Contact the maintainer directly through GitHub
Please include the following information when reporting a vulnerability:
- description of the issue
- steps to reproduce the behavior
- potential impact
- screenshots or logs if applicable
- suggested remediation if known
After a report is submitted:
- the issue will be reviewed and validated
- a response will typically be provided within a reasonable timeframe
- fixes will be investigated and implemented when necessary
- affected users may be notified through repository updates if applicable
Examples of issues that may fall within the scope of this policy include:
- exposed secrets or credentials
- dependency vulnerabilities
- security issues introduced through workflows
- malicious code execution possibilities
- cross-site scripting or injection vulnerabilities
- unauthorized access or unexpected behavior
General bugs, feature requests, and usability improvements should be submitted through the normal issue workflow instead of the security reporting process.
Contributors are encouraged to follow security best practices while contributing:
- never commit secrets or credentials
- keep dependencies updated
- review external packages before adding them
- avoid exposing sensitive information in logs
- verify GitHub workflow changes carefully
MonoNeural is committed to maintaining a secure and trustworthy open-source environment.