blob: 768a0212c68f899761b68f3fd49f449e52986d49 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
<!-- SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com> -->
<!-- SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-1.1 -->
# Security policy
Progmasoft Catch3 is an independent fork, not an official Catch2 release. Security reports for this repository must go to Progmasoft, not to upstream Catch2 maintainers.
## Supported code
We triage reports against the current `devel` branch and the latest tagged Catch3 release. Older tags and upstream Catch2 branches are not separately maintained here. A fix may be released or documented without a backport to every earlier tag.
## Private reporting
Email **support@progmasoft.com** with a concise description, affected revision, minimal reproduction, impact, and a safe way to reach you. Do not include credentials, private test fixtures, or exploit details in a public issue. We will coordinate disclosure after validating the report and preparing a fix or mitigation.
If the same flaw independently affects unmodified upstream Catch2, report it to its maintainers through their current security policy as a separate disclosure. Do not assume a Catch3 report reaches upstream.
|