Security Policy¶
The Modal Sandboxes team takes security and vulnerability management seriously.
Supported Versions¶
We provide security updates and patches for the following versions:
| Version | Supported |
|---|---|
| 0.1.x |  |
| < 0.1 |  |
Reporting a Vulnerability¶
If you discover a security vulnerability in this project, please do not open a public issue. Publicly disclosing a vulnerability can put all users and installations at risk.
Instead, please report the vulnerability privately via GitHub Private Vulnerability Reporting:
- Navigate to the Security tab of the repository on GitHub.
- Select Advisories under "Reporting".
- Click Report a vulnerability to open a confidential advisory draft.
- Include detailed information about the vulnerability:
- Summary and type of vulnerability (e.g. secret leakage, arbitrary command execution, privilege escalation)
- Step-by-step reproduction instructions or proof-of-concept
- Impacted modules or CLI flags
- Suggested mitigations or patches (if available)
Disclosure Policy¶
- Maintainers will acknowledge receipt within 48 hours.
- We will coordinate validation and development of a security patch.
- We will publish a patched release and credit the reporter in the advisory release notes (unless anonymity is requested).