Security

# Supported Versions

Currently, the following versions of Zedda are supported with security updates:

Version	Supported
0.4.x	:white_check_mark:
< 0.4.0	:x:

# Reporting a Vulnerability

We take the security of Zedda very seriously. If you discover a security vulnerability in this project, please do not publicly disclose it.

Instead, report it privately to us through GitHub’s Security Advisories feature:

1. Go to the Security Advisories page of this repository.
2. Click on the “Report a vulnerability” button.
3. Provide a clear description of the issue, steps to reproduce it, and any potential impact.

We will acknowledge receipt of your vulnerability report within 48 hours.

# SLA by severity

FIX L-01: The previous SECURITY.md only specified a SLA for critical vulnerabilities. Reporters didn’t know what to expect for high/medium/low.

Severity	Acknowledgement	Fix target
Critical	48 hours	14 days
High	48 hours	30 days
Medium	7 days	90 days
Low	14 days	Next minor release

# What is considered a vulnerability?

Examples of vulnerabilities you should report securely:

• Buffer overflows or memory safety issues in the C++ core (src/).
• Path traversal or arbitrary file read vulnerabilities.
• Unsafe deserialization or command injection.
• Cross-Site Scripting (XSS) in HTML reports generated by zedda.report.render_html.
• Prompt injection in zd.ask() or AI features.

Thank you for helping keep Zedda secure!