Skip to content
Astral Documentation
Esc
↑↓navigate↵open⌘Jpreview
On this page

Security policy

Supported versions

Astral is pre-1.0 and under active development. Security fixes are applied to main (or the default branch). If/when release branches exist, this document will be updated with an explicit support matrix.

Reporting a vulnerability

Please report security issues through GitHub’s private vulnerability reporting form under the repository’s Security tab. Do not open a public issue with vulnerability details.

Include:

  • A clear description of the issue and impact
  • Reproduction steps / PoC (if available)
  • Affected platform(s), build preset(s), and commit SHA
  • Any suggested fix or mitigation

If the private reporting form is unavailable, open an issue containing no technical details and ask the maintainers to enable a private disclosure channel.

Disclosure process

  1. Triage and confirm the issue.
  2. Develop a fix and add regression coverage when practical.
  3. Coordinate disclosure timing (especially for downstream engine/plugin consumers).
  4. Publish an advisory and release notes when a tagged release process exists.

Source: View the pinned source · Edit this source