2022-03-07 20:55:51 +01:00
|
|
|
# Security policy
|
2022-03-04 12:09:16 +01:00
|
|
|
|
2022-03-07 20:55:51 +01:00
|
|
|
## Reporting a vulnerability
|
2022-03-04 12:09:16 +01:00
|
|
|
|
2022-03-07 20:55:51 +01:00
|
|
|
When you identify a vulnerability in HTTPie, please report it privately using one of the following channels:
|
2022-03-04 12:09:16 +01:00
|
|
|
|
2022-03-07 20:55:51 +01:00
|
|
|
- Email to [`security@httpie.io`](mailto:security@httpie.io)
|
|
|
|
|
- Report on [huntr.dev](https://huntr.dev/)
|
|
|
|
|
|
2022-03-07 20:57:03 +01:00
|
|
|
In addition to the description of the vulnerability, include the following information:
|
2022-03-07 20:55:51 +01:00
|
|
|
|
|
|
|
|
- A short reproducer to verify it (it can be a small HTTP server, shell script, docker image, etc.)
|
|
|
|
|
- Your deemed severity level of the vulnerability (`LOW`/`MEDIUM`/`HIGH`/`CRITICAL`)
|
|
|
|
|
- [CWE](https://cwe.mitre.org/) ID, if available.
|
