forkless/NotAlterra
1
0
Fork 0
mirror of https://github.com/forkless/NotAlterra.git synced 2026-08-16 16:37:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

add security disclosure documents

Browse Source
This commit is contained in:
forkless
2026-06-06 21:38:09 +02:00
parent 3566f41a92
commit 832ed30799
4 changed files with 225 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/ISSUE_TEMPLATE/bug_report.md
+18 -4
View File
@@ -6,18 +6,32 @@ labels: bug
assignees: ''
---
> **I will not respond to bug reports that are the equivalent of "It does
> not work!"** Provide the information below — what you did, what happened,
> what you expected, and your environment. Reports without these details
> will be closed without response.
**Describe the bug**
What happened and what did you expect to happen?
**Steps to reproduce**
1.
2.
3.
1.
2.
3.
**Environment**
- OS: (e.g. Windows 11, Ubuntu 24.04)
- OS: (e.g. Windows 11, Ubuntu 24.04, Steam Deck)
- NotAlterra version: (shown in the title bar)
- Subnautica 2 install: (Steam, Xbox, Epic, custom)
**Logs**
If available, attach `transaction.log` (located next to the binary).
**Privacy**
Do not paste save file contents, personal names, or full file paths. The
issue is public — include only what is necessary to reproduce the problem.
**Security issues**
Do not report security vulnerabilities here. Use the repository's
**Security** tab → **Report a vulnerability** instead, or email
forkless@protonmail.com.
SECURITY.md
+24 -2
View File
@@ -2,12 +2,34 @@
## Reporting a Vulnerability
If you discover a security issue in NotAlterra, please report it privately:
If you discover a security issue in NotAlterra, report it privately
through one of the channels below. Do **not** open a public issue.
### Preferred: GitHub Private Vulnerability Reporting
1. Go to the repository's **Security** tab:
<https://github.com/forkless/NotAlterra/security/advisories>
2. Click **Report a vulnerability**.
3. Fill in the form — no GPG needed, the thread is private by default.
4. GitHub can assign a CVE ID directly through their CNA.
### Fallback: Email
If you cannot use the GitHub advisory form, email the maintainer directly:
- **Email**: forkless@protonmail.com
- **GPG**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg)
Do not open a public issue.
Encrypted email is preferred when the report includes sensitive details
or proof-of-concept code.
## Safe Harbor
If you report a vulnerability in good faith and follow this policy —
report privately, allow time for a patch, do not publish exploit code
before a release — NotAlterra will not pursue legal action against you.
Your testing is authorized within the scope defined below. No other
authorization, express or implied, is granted.
## Response Timeline
docs/BUG_REPORT_TEMPLATE.md
+75
View File
@@ -0,0 +1,75 @@
# Bug Report Template
> **I will not respond to bug reports that are the equivalent of "It does
> not work!"** Provide the information below — what you did, what happened,
> what you expected, and your environment. Reports without these details
> will be closed without response.
Copy the section below into a new GitHub issue at
<https://github.com/forkless/NotAlterra/issues/new> and fill it out.
---
```markdown
### Describe the bug
What happened? What did you expect to happen instead?
### Steps to reproduce
1.
2.
3.
### Environment
- **OS**: (e.g. Windows 11, Ubuntu 24.04, Steam Deck)
- **NotAlterra version**: (shown in the title bar, e.g. v0.4.0)
- **Subnautica 2 install**: (Steam, Xbox, Epic, custom)
### Logs
If available, attach the `transaction.log` file located next to the
binary (`logs/transaction.log`).
### Screenshots (optional)
If the terminal output is relevant, paste a screenshot or a copy of the
on-screen text.
```
---
## Privacy
Do not paste save file contents, personal names, or anything you consider
private into the issue. Do not paste full file paths that might reveal
your real name or system layout — the tool's `transaction.log` is
sanitized, but your issue is public.
When in doubt, omit it. Include only what is necessary to reproduce the
problem.
---
## Security Issues
**Do not** report security vulnerabilities through a public GitHub issue.
### Preferred: GitHub Private Vulnerability Reporting
1. Go to the repository's **Security** tab:
<https://github.com/forkless/NotAlterra/security/advisories>
2. Click **Report a vulnerability** — the thread is private by default.
### Fallback: Email
If you cannot use the GitHub advisory form, email the maintainer:
- **Email**: forkless@protonmail.com
- **GPG key**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg)
Reports are acknowledged within 48 hours. Patches are committed within
48 hours of triage, followed by a public advisory after the release ships.
For more detail, see `SECURITY.md` in the project root.
docs/CVE_TEMPLATE.md
+108
View File
@@ -0,0 +1,108 @@
# CVE Vulnerability Report Template
**CVE** (Common Vulnerabilities and Exposures) is a standardized identifier
for publicly known security vulnerabilities — `CVE-2026-XXXXX`. Not every
bug qualifies; CVEs are reserved for security-relevant flaws that affect
confidentiality, integrity, or availability.
This template helps you report a potential CVE-class vulnerability in
NotAlterra. Use it before public disclosure — a patch should ship before a
CVE is published.
---
## ⚠️ No Public Disclosure
**Do not** file a public GitHub issue, post on forums, or discuss the
vulnerability on social media before a patch is released. Premature
disclosure puts every user of the tool at risk.
Report privately to the maintainer instead (see below).
---
## Template
Copy and fill out the section below into an email. Attach supporting files
(proof-of-concept, logs, crash dumps) directly.
```
Subject: [NotAlterra Security] <brief description>
### Vulnerability type
- [ ] Path traversal / arbitrary file write
- [ ] Silent data corruption during backup or restore
- [ ] Denial of service (crash / hang on crafted input)
- [ ] Dependency vulnerability (CVE in a library)
- [ ] Other: ___________
### Description
What does the vulnerability allow an attacker to do? What conditions
are required?
### Steps to reproduce
1.
2.
3.
### Proof of concept (if applicable)
Attach or paste a minimal input, script, or sequence of actions that
triggers the issue.
### Affected versions
- NotAlterra version(s): (e.g. v0.4.0)
- Platform: (Windows / Linux / both)
### Impact assessment
- [ ] Data loss possible
- [ ] Remote code execution (unlikely — no network surfaces)
- [ ] Privilege escalation (runs in user context, no admin required)
- [ ] Other: ___________
### Suggested CVE assignment
- [ ] I intend to request a CVE ID for this issue
- [ ] I am not requesting a CVE (report only)
```
---
## Where to Send
### Preferred: GitHub Private Vulnerability Reporting
1. Go to the repository's **Security** tab:
<https://github.com/forkless/NotAlterra/security/advisories>
2. Click **Report a vulnerability**.
3. Fill in the template fields — the thread is private by default.
4. GitHub can assign a CVE ID directly through their CNA without MITRE
coordination.
### Fallback: Email
If you cannot use the GitHub advisory form, email the maintainer with
the completed template:
- **Email**: forkless@protonmail.com
- **GPG key**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg)
Encrypted email is preferred when the report includes sensitive details
or proof-of-concept code.
## What Happens Next
1. **Acknowledgment** — within 48 hours of receipt.
2. **Triage** — the maintainer assesses severity and reproduces the issue.
3. **Patch** — fix committed within 48 hours of triage.
4. **CVE request** — the maintainer requests a CVE ID from MITRE or a
CVE Numbering Authority (CNA) if the issue qualifies.
5. **Disclosure** — after the patched release ships, a public advisory is
published and the CVE is made public.
For the full policy, see `SECURITY.md` in the project root.