This policy applies to every repository in the team-apm organization that does not provide its own SECURITY.md.
The apm desktop application has its own policy, which takes precedence for that repository.
Preferred: open a private report through GitHub Security Advisories on the affected repository.
Alternative: open a minimal public issue asking for a private contact channel.
Please do not disclose security issues in public issues with full exploit details before a fix is available.
- Description of the vulnerability
- Steps to reproduce
- Affected repository and version (or commit)
- Impact assessment (if known)
- Acknowledgement: within 7 days
- Status update: within 30 days, or an explanation of delay
- Fix: coordinated disclosure after a patch release when possible
We appreciate responsible disclosure and will credit reporters in the release notes when appropriate.
The repositories here are not all applications, so the threat model differs. This table is a guide, not an exhaustive list.
| Repository | Security-relevant because | Examples |
|---|---|---|
| apm-data | It is the package metadata that apm downloads and acts on. A user installs whatever this data points at. | A download URL pointing at an attacker-controlled host; an integrity hash that does not match the file it guards; an install path that escapes the installation directory |
| apm-schema | It defines which shapes of package data apm will accept. A gap here removes a check from every consumer. | A constraint that fails to reject a hostile value that apm then trusts |
| apm-web | It is a static site that produces package data from user input. | Cross-site scripting; generating data that bypasses schema validation |
| team-apm.github.io | It serves the organization's public pages. | Content injection; a link or redirect to an untrusted host |
- Vulnerabilities in AviUtl itself, or in third-party plugins and scripts distributed by their own authors. Report those to the respective author. If the packaged data in apm-data points at a compromised distribution, that is in scope — report it here.
- Reports produced solely by an automated scanner, with no demonstrated impact on this code.