Security policy

This page covers Tinka's security policy. You will learn how to:

• Report a vulnerability privately
• Know which versions get security fixes
• Know which APIs can change, from the alpha to v1.0.0

Overview

Tinka is the foundation your App's security rests on, so its own security is handled with care: issues are reported privately, fixed before they're disclosed, and published where Go's tooling finds them, so govulncheck tells you when your App uses an affected version.

Report a vulnerability

Report security issues privately, through GitHub's private vulnerability reporting: open the repository's Security tab and choose Report a vulnerability. Don't open a public issue, pull request or discussion for a security problem: until a fix is released, everyone who uses Tinka would be exposed.

Include what you found, the version (tinka version, or the version in your App's go.mod), and the steps or code that show it. You'll get an answer within a week. Once a fix is released, the issue is published as a GitHub security advisory and in Go's vulnerability database. Reporters are credited, unless they ask not to be.

Supported versions

Until v1.0.0, only the latest release gets security fixes: a fix ships in the next release, and you upgrade to get it. From v1.0.0, the latest minor release of 1.x gets fixes.

Check your App for known vulnerabilities, in Tinka, Go and every other module it uses, with govulncheck:

go run golang.org/x/vuln/cmd/govulncheck@latest ./...

It reports only the vulnerabilities your code can reach.

Stability

How much Tinka's APIs can change depends on the release:

During the alpha, pin the version your App builds against in its go.mod, and read the release notes before you upgrade.

See also: Releases, Roadmap, Contributing