# Security policy

This repository ships a defensive tool. A defect in it is a security issue when it makes an operator
believe a host is protected while it is not.

## What counts as a vulnerability here

| Class | Example | Severity |
|---|---|---|
| False negative in detection | a vulnerable version classified as `SAFE` | critical |
| False green in verification | `VERIFY: PASS` while a server consumer maps a pre-patch inode | critical |
| Bypass of the authenticity gate | a candidate without the CVE in its changelog is installed anyway | high |
| Unsafe restart | a restart that takes down the session, the panel or a database | high |
| Failed rollback | the backup cannot restore the previous library | high |
| Information leak | a report that writes credentials, tokens or customer hostnames | medium |
| Missing check | a decode path that the audit does not look at, when a reproduction is provided | medium |

A defect that merely stops the tool (syntax error, missing dependency, wrong exit code on a
supported path) is a normal bug: open an issue.

## What does not belong here

- Vulnerabilities in Google Brotli itself: report them upstream and to the distribution security
  team. This repository only remediates them.
- Vulnerabilities in nginx, Apache, Node.js, Envoy, .NET or a hosting panel: report them to the
  respective vendor.
- A host that was not patched because the operator skipped a step: that is an operating question,
  not a tool vulnerability.

## Reporting

Open a private advisory on GitHub:

<https://github.com/paulmann/CVE-2026-111497/security/advisories/new>

Include:

1. the affected script and the function;
2. the host state that triggers it — distribution, package versions, consumer list;
3. the command you ran and its output;
4. why the outcome is wrong, and what a correct outcome would look like.

Do not include credentials, real addresses or customer names. Hosts can be described as
`Debian 12, libbrotli1 1.0.9-2+b6, apache2 + php-fpm`.

## Response

| Stage | Target |
|---|---|
| Acknowledgement | 72 hours |
| Triage and severity | 7 days |
| Fix for a critical class (false negative, false green) | 30 days |
| Fix for a medium class | next minor release |
| Public advisory | after the fix is released, coordinated with the reporter |

Credit is given in the advisory unless the reporter asks otherwise.

## What the tool promises about itself

- It writes nothing outside `/var/lib/cve-2026-111497/` and `/root/cve-2026-111497-fix-*/` except
  the package installation and the service restarts it reports.
- It refuses to install without a changelog that names the CVE.
- It contains no credentials, tokens, addresses or hostnames, and CI fails if one appears.

## Supported versions

| Version | Supported |
|---|---|
| 1.1.x | yes |
| 1.0.x | security fixes only |
| < 1.0 | no |