If you discover a security vulnerability in OpenRL, please report it responsibly. Do not open a public GitHub issue.
To report a vulnerability, use GitHub Private Vulnerability Reporting:
Please include in your report:
- Description of the vulnerability
- Steps to reproduce the issue
- Affected versions
- Any potential impact you have identified
The OpenRL security response team will acknowledge receipt of your report within 3 business days and will provide an estimated timeline for a fix within 10 business days.
The team will keep you informed of progress toward a fix and may ask for additional information.
OpenRL has not yet cut a tagged release. Until the first release, only the main branch is
supported and security fixes land there.
| Version | Supported |
|---|---|
main |
Yes |
When a security issue is confirmed, the OpenRL maintainers will:
- Develop and test a fix
- Assign a CVE identifier if appropriate
- Release a patched version
- Publish a security advisory via GitHub Security Advisories
The security response team handles all reports of security vulnerabilities according to this policy. See GOVERNANCE.md for how the security response team is appointed and maintained, and MAINTAINERS.md for the current members.
The project maintains the following security practices:
- Automated dependency updates via Dependabot
- Linting and build checks on every pull request
This is not an officially supported Google product. This project is not eligible for the Google Open Source Software Vulnerability Rewards Program.