cita
136a038538
- Updated modelTesterSession tests to serialize assistant history as output_text and removed mime_type from input_file. - Introduced new tests for stats proxy logs routes, covering paginated log retrieval and detailed log views with parsed billing details. - Added server-driven tests for ProxyLogs component to validate API interactions and UI rendering based on server data.
38 lines
1.5 KiB
Markdown
38 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
- The latest release on GitHub.
|
|
- The current `main` branch.
|
|
|
|
Older tags and ad-hoc forks may receive guidance, but they are not guaranteed security backports.
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please do not report security issues in public issues, discussions, or pull requests.
|
|
|
|
Use one of these channels:
|
|
|
|
1. GitHub Security Advisory private report: `https://github.com/cita-777/metapi/security/advisories/new`
|
|
2. Email: `cita-777@users.noreply.github.com` with subject prefix `[metapi security]`
|
|
|
|
When reporting, include:
|
|
|
|
- Affected version, commit, or deployment mode
|
|
- Affected endpoint, module, or configuration surface
|
|
- Reproduction steps or proof-of-concept
|
|
- Expected impact and attack preconditions
|
|
- Any logs, screenshots, or packets with secrets redacted
|
|
- Suggested mitigation or patch ideas, if you already have them
|
|
|
|
## Response Process
|
|
|
|
- We aim to acknowledge private reports within 3 business days.
|
|
- We aim to provide an initial triage or follow-up questions within 7 business days.
|
|
- We may ask for extra reproduction details, redacted logs, or environment information before confirming severity.
|
|
- We coordinate disclosure with the reporter when possible. Please keep the report private until a fix or mitigation is ready.
|
|
|
|
## Handling Public Reports
|
|
|
|
If a vulnerability is posted publicly by mistake, maintainers may redact sensitive details, convert the report to a private channel, or close the public thread after redirecting the reporter to the private process above.
|