There are no backports. A fork is expected to merge fixes from upstream as they land. Unreleased main is not supported.

Report vulnerabilities privately through GitHub's Private Vulnerability Reporting. Do not open a public issue for a security bug.

1. Open https://github.com/staticwire/aurtomator/security/advisories/new.
2. Fill in the advisory form: affected components, reproduction steps, impact, and any suggested mitigation.
3. Attach proof-of-concept material to the draft advisory instead of linking to external services.
4. Submit. The advisory stays private between you and the maintainer until it is published.

Expect an acknowledgment within 7 days. aurtomator has one maintainer, and there is no SLA for triage, fix or disclosure after the acknowledgment. Without an acknowledgment after 7 days, submit a new advisory that mentions the first one.

In scope:

• scripts/: any defect that allows arbitrary code execution, secret exfiltration, or writes outside the working tree.
• strategies/: injection through crafted upstream responses, YAML parsing issues, or command injection through package configuration.
• .github/workflows/: misconfiguration that leaks the AUR_SSH_KEY, GPG_SIGNING_KEY, AUR_GIT_NAME or AUR_GIT_EMAIL secrets into logs, artifacts, forks, pull requests or third-party actions.
• Anything else in this repository that can make a fork push a compromised package to the AUR without the fork maintainer's intent.

Out of scope:

• Vulnerabilities in external tools that aurtomator calls (makepkg, yq, curl, git, namcap, shellcheck, shfmt, bats). Report those upstream.
• The contents of AUR packages published by forks. Each fork maintainer is responsible for the packages they publish.
• The fork model itself, for example that a malicious fork can push a bad package.
• Issues in third-party GitHub Actions. Report them to the action's maintainer. aurtomator pins every action by commit SHA.

Once a reported issue is fixed, the advisory is published on the repository's Security tab. A CVE assigned through GitHub's CNA is referenced in the published advisory. A fork gets the fix with its next merge from upstream. Watching this repository's releases gives a notification when a fix ships.