View Source Security policy
Supported versions
Until a later release establishes a broader policy, security fixes are applied to the latest published minor version.
| Version | Supported |
|---|---|
| 0.2.x | Yes |
| 0.1.x | No |
| Earlier versions | No |
Reporting a vulnerability
Do not open a public issue for a suspected vulnerability.
Use GitHub's private vulnerability reporting feature from the repository's Security tab. Include:
- the affected version;
- a minimal reproduction;
- expected and observed behavior;
- potential impact;
- any suggested mitigation.
Avoid including secrets, private source code, or production report artifacts unless the maintainer explicitly requests them through a secure channel.
You should receive an acknowledgement within seven days. The maintainer will then assess severity, coordinate a fix, and disclose the issue after an appropriate release is available.
Sensitive report data
Atlas reports contain test names, step and check names, assertion messages, and stacktraces. These may reveal source paths or business rules. Treat report files as test artifacts and review them before making them public.