Security Policy
DigiEmu takes security issues affecting its public software, documentation and infrastructure seriously.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Please report suspected security vulnerabilities privately to:
Include enough information for the issue to be understood and reproduced where reasonably possible.
Useful details include:
- affected DigiEmu technology or service
- version or revision
- operating environment
- expected behavior
- observed behavior
- reproduction steps
- relevant non-sensitive logs or evidence
- potential security impact
Please do not publish sensitive details
Section titled “Please do not publish sensitive details”Do not publish:
- credentials
- private keys
- confidential evidence
- customer or personal data
- exploit details that would unnecessarily expose users before the issue can be reviewed
Reports may concern publicly accessible DigiEmu infrastructure or publicly distributed DigiEmu software.
Individual repositories and products may define additional security boundaries or reporting guidance.
Verification
Section titled “Verification”Where practical, reports should include reproducible technical evidence.
DigiEmu distinguishes between:
- a security observation
- evidence supporting the observation
- verification of the affected behavior
- remediation and subsequent verification
Responsible disclosure
Section titled “Responsible disclosure”Please allow reasonable time to investigate a report before publishing vulnerability details.
Submitting a report does not imply a bug bounty, financial reward or contractual commitment.
Contact
Section titled “Contact”Security reports:
General developer documentation: