For discovery, see also: https://flyingrobots.dev/.well-known/security.txt.
Privacy: We store vulnerability reports in restricted systems, retain PII only as needed for communication, und purge within 180 days after closure.
Only ze latest stable major release receives ze vigilance of BunBun's keen ears und my quill (currently: 1.x).
Vhen a new major symphony is released, ze previous major becomes silent forever—no more security patches!
Vithin ze supported major, only ze latest minor movement gets attention (no N-1 minors).
Ve vill announce zese EOL dates in RELEASES.md ze moment a new major composition debuts.
| Version | Supported |
|---|---|
| 1.x | ✅ |
| 0.x | ❌ |
Only ze latest stable major release (1.x) receives ze vigilance of BunBun’s keen ears und my quill.
Anything older is marked as obsolete; no security corrections vill be written for zem.
If you perceive a crack in ze harmony — a vulnerability, an opening for mischief — you must not announce it upon ze public stage.
Instead, you vill whisper directly to ze Kapellmeister und his rabbit.
- Contact: james@flyingrobots.dev
- Contents of your report:
- Concise description of ze flaw
- Affected version(s)
- Steps to reproduce (as precise as a fugue subject)
- Acknowledgement: Within 72 hours you vill receive ze nod of receipt.
- Updates: At least once per 7 business days, you vill hear from us until resolution or decline.
- Resolution: Should ze vulnerability be judged valid, a patch vill be issued upon ze supported version(s).
Credit vill be given unless anonymity is requested.
Do not, under any circumstance, open a public GitHub issue for ze matter. Such disorder vould unleash cacophony. May BunBun have mercy on your code.
- Adagio (Day 0–3): Vulnerability received, acknowledged within 72 hours.
- Andante (Day 3–10): Initial triage and reproduction attempt.
- Allegro (Day 10–30): Fix prepared, tested, and patched in supported version(s).
- Finale (Post-Release): Reporter credited (or kept anonymous), public disclosure note published.
Any attempt to leap from Adagio straight to Finale (i.e., public blast before private fix)
shall be treated as dissonance — forbidden modulation.
Security is no jest. It is ze bass line upon vich all other melodies rely.
BunBun may stack his Red Bull cans carelessly to ze heavens, but vulnerabilities must be handled mit precision, formality, und care.
To report in good faith is to join ze orchestra of order.
To disclose in public before ze patch? Barbaric. Out of tempo. Nein. Verbotten.
Signed,
P.R. PhiedBach
Kapellmeister of Commits; Keeper of BunBun’s Red Bull Pyramid