Security Policy
Public repository documentation · View source on GitHub
On this page
This repository distributes more than one application. Reporting happens through the shared hub, but each product has its own data handling, supported versions, signing and update behavior. Do not apply one product's guarantees to another.
Reporting a vulnerability
Do not open a public issue for a security vulnerability.
Use GitHub's Report a vulnerability action. Include the product name, version, installation format, impact and reproduction steps. Prefer synthetic evidence. Redact credentials and private personal, customer or business data from files, screenshots, logs and generated output before sharing; do not assume an app has removed every sensitive detail.
What to expect
| Stage | Target |
|---|---|
| Acknowledgement | Within 3 business days |
| Initial assessment | Within 5 business days |
| Critical issue | Prioritized ahead of feature work |
| Advisory and credit | Coordinated with the reporter when the fix is released |
These are response targets, not guaranteed resolution dates. Allow a reasonable disclosure window. Good-faith reports that respect user privacy and avoid service disruption are welcome; reporters are credited unless they prefer anonymity.
Product security and data handling
Choose the policy for the application you are using:
| Product | Security policy | Data handling |
|---|---|---|
| Threat Model Reviewer | Product security | Threat model data and optional integrations |
| shot2code | Security guides on the product page | Privacy overview and detailed guide links |
Local processing does not mean that every feature is offline. Review the selected product's provider, sharing and update settings before using private inputs.
Security of the product itself
Controls and limitations are documented in each product policy. A successful workflow, generated artifact or downloaded installer is not a security assessment or third-party approval. Review the applicable product's claims and limitations.
Supported versions
Use the product-specific policy and release list. The repository-wide
releases/latest endpoint can refer to a different application, and version
numbers from different products must not be compared.
| Product | Releases and downloads | Support policy |
|---|---|---|
| Threat Model Reviewer | Threat Model Reviewer releases | Supported versions |
| shot2code | shot2code releases | Product security and update guides |
Code signing
Signing, checksums and automatic-update support vary by product and package format. Follow the corresponding product's installation and security guides; do not assume that every file in this repository is signed or self-updating.
Download from the product's release page, compare available integrity metadata and verify the expected publisher before installation. A self-signed certificate is not a publicly trusted certificate. Never disable an organization's controls or bypass an administrator-enforced block to install a package; obtain IT approval.