diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 2be5b98..a043683 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -6,18 +6,32 @@ labels: bug assignees: '' --- +> **I will not respond to bug reports that are the equivalent of "It does +> not work!"** Provide the information below — what you did, what happened, +> what you expected, and your environment. Reports without these details +> will be closed without response. + **Describe the bug** What happened and what did you expect to happen? **Steps to reproduce** -1. -2. -3. +1. +2. +3. **Environment** -- OS: (e.g. Windows 11, Ubuntu 24.04) +- OS: (e.g. Windows 11, Ubuntu 24.04, Steam Deck) - NotAlterra version: (shown in the title bar) - Subnautica 2 install: (Steam, Xbox, Epic, custom) **Logs** If available, attach `transaction.log` (located next to the binary). + +**Privacy** +Do not paste save file contents, personal names, or full file paths. The +issue is public — include only what is necessary to reproduce the problem. + +**Security issues** +Do not report security vulnerabilities here. Use the repository's +**Security** tab → **Report a vulnerability** instead, or email +forkless@protonmail.com. diff --git a/SECURITY.md b/SECURITY.md index 9e2861e..ec78fff 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,12 +2,34 @@ ## Reporting a Vulnerability -If you discover a security issue in NotAlterra, please report it privately: +If you discover a security issue in NotAlterra, report it privately +through one of the channels below. Do **not** open a public issue. + +### Preferred: GitHub Private Vulnerability Reporting + +1. Go to the repository's **Security** tab: + +2. Click **Report a vulnerability**. +3. Fill in the form — no GPG needed, the thread is private by default. +4. GitHub can assign a CVE ID directly through their CNA. + +### Fallback: Email + +If you cannot use the GitHub advisory form, email the maintainer directly: - **Email**: forkless@protonmail.com - **GPG**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg) -Do not open a public issue. +Encrypted email is preferred when the report includes sensitive details +or proof-of-concept code. + +## Safe Harbor + +If you report a vulnerability in good faith and follow this policy — +report privately, allow time for a patch, do not publish exploit code +before a release — NotAlterra will not pursue legal action against you. +Your testing is authorized within the scope defined below. No other +authorization, express or implied, is granted. ## Response Timeline diff --git a/docs/BUG_REPORT_TEMPLATE.md b/docs/BUG_REPORT_TEMPLATE.md new file mode 100644 index 0000000..a54a638 --- /dev/null +++ b/docs/BUG_REPORT_TEMPLATE.md @@ -0,0 +1,75 @@ +# Bug Report Template + +> **I will not respond to bug reports that are the equivalent of "It does +> not work!"** Provide the information below — what you did, what happened, +> what you expected, and your environment. Reports without these details +> will be closed without response. + +Copy the section below into a new GitHub issue at + and fill it out. + +--- + +```markdown +### Describe the bug + +What happened? What did you expect to happen instead? + +### Steps to reproduce + +1. +2. +3. + +### Environment + +- **OS**: (e.g. Windows 11, Ubuntu 24.04, Steam Deck) +- **NotAlterra version**: (shown in the title bar, e.g. v0.4.0) +- **Subnautica 2 install**: (Steam, Xbox, Epic, custom) + +### Logs + +If available, attach the `transaction.log` file located next to the +binary (`logs/transaction.log`). + +### Screenshots (optional) + +If the terminal output is relevant, paste a screenshot or a copy of the +on-screen text. +``` + +--- + +## Privacy + +Do not paste save file contents, personal names, or anything you consider +private into the issue. Do not paste full file paths that might reveal +your real name or system layout — the tool's `transaction.log` is +sanitized, but your issue is public. + +When in doubt, omit it. Include only what is necessary to reproduce the +problem. + +--- + +## Security Issues + +**Do not** report security vulnerabilities through a public GitHub issue. + +### Preferred: GitHub Private Vulnerability Reporting + +1. Go to the repository's **Security** tab: + +2. Click **Report a vulnerability** — the thread is private by default. + +### Fallback: Email + +If you cannot use the GitHub advisory form, email the maintainer: + +- **Email**: forkless@protonmail.com +- **GPG key**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg) + +Reports are acknowledged within 48 hours. Patches are committed within +48 hours of triage, followed by a public advisory after the release ships. + +For more detail, see `SECURITY.md` in the project root. diff --git a/docs/CVE_TEMPLATE.md b/docs/CVE_TEMPLATE.md new file mode 100644 index 0000000..1d637d3 --- /dev/null +++ b/docs/CVE_TEMPLATE.md @@ -0,0 +1,108 @@ +# CVE Vulnerability Report Template + +**CVE** (Common Vulnerabilities and Exposures) is a standardized identifier +for publicly known security vulnerabilities — `CVE-2026-XXXXX`. Not every +bug qualifies; CVEs are reserved for security-relevant flaws that affect +confidentiality, integrity, or availability. + +This template helps you report a potential CVE-class vulnerability in +NotAlterra. Use it before public disclosure — a patch should ship before a +CVE is published. + +--- + +## ⚠️ No Public Disclosure + +**Do not** file a public GitHub issue, post on forums, or discuss the +vulnerability on social media before a patch is released. Premature +disclosure puts every user of the tool at risk. + +Report privately to the maintainer instead (see below). + +--- + +## Template + +Copy and fill out the section below into an email. Attach supporting files +(proof-of-concept, logs, crash dumps) directly. + +``` +Subject: [NotAlterra Security] + +### Vulnerability type + +- [ ] Path traversal / arbitrary file write +- [ ] Silent data corruption during backup or restore +- [ ] Denial of service (crash / hang on crafted input) +- [ ] Dependency vulnerability (CVE in a library) +- [ ] Other: ___________ + +### Description + +What does the vulnerability allow an attacker to do? What conditions +are required? + +### Steps to reproduce + +1. +2. +3. + +### Proof of concept (if applicable) + +Attach or paste a minimal input, script, or sequence of actions that +triggers the issue. + +### Affected versions + +- NotAlterra version(s): (e.g. v0.4.0) +- Platform: (Windows / Linux / both) + +### Impact assessment + +- [ ] Data loss possible +- [ ] Remote code execution (unlikely — no network surfaces) +- [ ] Privilege escalation (runs in user context, no admin required) +- [ ] Other: ___________ + +### Suggested CVE assignment + +- [ ] I intend to request a CVE ID for this issue +- [ ] I am not requesting a CVE (report only) +``` + +--- + +## Where to Send + +### Preferred: GitHub Private Vulnerability Reporting + +1. Go to the repository's **Security** tab: + +2. Click **Report a vulnerability**. +3. Fill in the template fields — the thread is private by default. +4. GitHub can assign a CVE ID directly through their CNA without MITRE + coordination. + +### Fallback: Email + +If you cannot use the GitHub advisory form, email the maintainer with +the completed template: + +- **Email**: forkless@protonmail.com +- **GPG key**: [314BB48A3C72D8EC2830B8BED2B0DF63E2CBEA16](https://github.com/forkless.gpg) + +Encrypted email is preferred when the report includes sensitive details +or proof-of-concept code. + +## What Happens Next + +1. **Acknowledgment** — within 48 hours of receipt. +2. **Triage** — the maintainer assesses severity and reproduces the issue. +3. **Patch** — fix committed within 48 hours of triage. +4. **CVE request** — the maintainer requests a CVE ID from MITRE or a + CVE Numbering Authority (CNA) if the issue qualifies. +5. **Disclosure** — after the patched release ships, a public advisory is + published and the CVE is made public. + +For the full policy, see `SECURITY.md` in the project root.