We appreciate community efforts to improve the security and robustness of Filament. If you discover a potential security vulnerability, please report it by opening an Issue on GitHub:
- Report via GitHub Issues: Open an issue describing the vulnerability in detail.
- Report Requirements:
- The exact code location (source file path and relevant line numbers).
- A clear technical explanation of the vulnerability mechanism.
- Standard step-by-step reproduction instructions or a clear explanation of how the issue can be triggered in realistic Filament usage scenarios.
- Triage & Timelines: We make no guarantees regarding response times or fix timeframes. Security issues will be evaluated and prioritized according to our regular development roadmap and backlog.
Filament does not accept unsolicited security pull requests.
We regularly receive low-quality, automated, or AI-generated security pull requests proposing speculative or broken changes without understanding Filament's architecture. As a result:
- All unsolicited security pull requests will be closed systematically without review.
- This applies especially to automated vulnerability scanner outputs and AI-generated patches.
- If you believe you have discovered a vulnerability, please file an Issue instead. If maintainers determine a fix is required, it will be designed and implemented directly by the project maintainers.
- Filament is an open-source project and does not participate in bug bounty programs or offer financial rewards.
- We do not provide CVE credits, CVE assignment assistance, or contributor attribution ("street cred") for unsolicited, automated, or AI-generated vulnerability submissions.