mirror of
https://github.com/CherryHQ/cherry-studio.git
synced 2025-12-19 06:30:10 +08:00
65 lines
2.3 KiB
Markdown
65 lines
2.3 KiB
Markdown
# Security Policy
|
|
|
|
## 📢 Reporting a Vulnerability
|
|
|
|
At Cherry Studio, we take security seriously and appreciate your efforts to responsibly disclose vulnerabilities. If you discover a security issue, please report it as soon as possible.
|
|
|
|
**Please do not create public issues for security-related reports.**
|
|
|
|
- To report a security issue, please use the GitHub Security Advisories tab to "[Open a draft security advisory](https://github.com/CherryHQ/cherry-studio/security/advisories/new)".
|
|
- Include a detailed description of the issue, steps to reproduce, potential impact, and any possible mitigations.
|
|
- If applicable, please also attach proof-of-concept code or screenshots.
|
|
|
|
We will acknowledge your report within **72 hours** and provide a status update as we investigate.
|
|
|
|
---
|
|
|
|
## 🔒 Supported Versions
|
|
|
|
We aim to support the latest released version and one previous minor release.
|
|
|
|
| Version | Supported |
|
|
|-----------------|--------------------|
|
|
| Latest (`main`) | ✅ Supported |
|
|
| Previous minor | ✅ Supported |
|
|
| Older versions | ❌ Not supported |
|
|
|
|
If you are using an unsupported version, we strongly recommend updating to the latest release to receive security fixes.
|
|
|
|
---
|
|
|
|
## 💡 Security Measures
|
|
|
|
Cherry Studio integrates several security best practices, including:
|
|
|
|
- Strict dependency updates and regular vulnerability scanning.
|
|
- TypeScript strict mode and linting to reduce potential injection or runtime issues.
|
|
- Enforced code formatting and pre-commit hooks.
|
|
- Internal security reviews before releases.
|
|
- Dedicated MCP (Model Context Protocol) safeguards for model interactions and data privacy.
|
|
|
|
---
|
|
|
|
## 🛡️ Disclosure Policy
|
|
|
|
- We follow a **coordinated disclosure** approach.
|
|
- We will not publicly disclose vulnerabilities until a fix has been developed and released.
|
|
- Credit will be given to researchers who responsibly disclose vulnerabilities, if requested.
|
|
|
|
---
|
|
|
|
## 🤝 Acknowledgements
|
|
|
|
We greatly appreciate contributions from the security community and strive to recognize all researchers who help keep Cherry Studio safe.
|
|
|
|
---
|
|
|
|
## 🌟 Questions?
|
|
|
|
For any security-related questions not involving vulnerabilities, please reach out to:
|
|
**security@cherry-ai.com**
|
|
|
|
---
|
|
|
|
Thank you for helping keep Cherry Studio and its users secure!
|