Security Policy
Syncraft Labs takes the security of our libraries, developer tooling, and downstream users seriously. This document details our version support lifecycle, responsible vulnerability disclosure process, and response service-level agreements (SLAs).
Supported Versions
Section titled “Supported Versions”We actively maintain and provide security patches for the following versions:
| Package | Version Range | Security Support Status |
|---|---|---|
@syncraft-labs/core |
>= 0.4.2 |
Supported (Active) |
@syncraft-labs/react |
>= 0.4.2 |
Supported (Active) |
@syncraft-labs/vue |
>= 0.4.2 |
Supported (Active) |
| All packages | 0.4.1 |
Revoked & Deprecated (See Advisory SYNCRAFT-SEC-2026-001) |
| All packages | <= 0.4.0 |
End of Life (EOL) — Please upgrade to latest |
Reporting a Vulnerability
Section titled “Reporting a Vulnerability”If you discover a potential vulnerability, please report it privately rather than creating a public GitHub issue.
Preferred Reporting Method
Section titled “Preferred Reporting Method”Submit a private advisory through GitHub Security Advisories. This provides a secure, encrypted workspace where we can collaborate on a fix and coordinate a synchronized release.
Direct Email Contact
Section titled “Direct Email Contact”If you cannot access GitHub Security Advisories, send an email directly to:
- Primary Maintainer:
denislistiadi24@gmail.com - Subject:
[SECURITY] Syncraft Labs Vulnerability Report
What to Include in Your Report
Section titled “What to Include in Your Report”- Description of the vulnerability and its potential impact.
- Affected package(s) and version(s).
- Detailed reproduction steps or a minimal Proof of Concept (PoC).
- Any potential mitigations or suggested patches.
Response Timeline & SLAs
Section titled “Response Timeline & SLAs”| Phase | Target SLA | Description |
|---|---|---|
| Initial Acknowledgment | 24–48 hours | Confirm receipt of report and open internal tracking |
| Triage & Validation | 3–5 business days | Reproduce and assess severity/scope |
| Remediation & Patch | Based on severity | Develop fix, run full test suites, and coordinate release |
| Public Advisory | Upon release | Publish CVE / GitHub Advisory with credits to reporter |
Safe Harbor Policy
Section titled “Safe Harbor Policy”We strongly support ethical security research. We will not pursue legal action against researchers who report vulnerabilities in good faith, provided that:
- You give us reasonable time to investigate and resolve the issue before disclosing it publicly.
- You do not compromise user data, disrupt system availability, or cause data destruction.
- You operate within the scope of responsible disclosure.