wehub-resource-sync
39 lines
1.1 KiB
Markdown
39 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
|---------|--------------------|
|
|
| 3.4.x | :white_check_mark: |
|
|
| < 3.4 | :x: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in MNN, please report it responsibly.
|
|
|
|
**DO NOT open a public GitHub issue for security vulnerabilities.**
|
|
|
|
Please email security reports to: **zhaode.wzd@alibaba-inc.com**
|
|
|
|
Include the following in your report:
|
|
- Description of the vulnerability
|
|
- Steps to reproduce
|
|
- Affected versions
|
|
- Potential impact
|
|
|
|
We will acknowledge receipt within 48 hours and provide a detailed response within 7 days.
|
|
|
|
## Scope
|
|
|
|
The following are in scope for security reports:
|
|
- Memory safety issues (buffer overflow, use-after-free, etc.)
|
|
- Model file parsing vulnerabilities
|
|
- Input validation issues in inference APIs
|
|
- Vulnerabilities in the model converter
|
|
|
|
## Disclosure Policy
|
|
|
|
- We follow a 90-day coordinated disclosure timeline
|
|
- Security patches will be released as part of regular version updates
|
|
- Credit will be given to reporters in release notes (unless anonymity is requested)
|