jci-coverage is pre-1.0 software; the public API and CLI surface may still change ahead of 1.0 (see the README). Security fixes are made against the latest released 0.1.x version. Users should track the latest release.

There is no long-term-support branch while the project is pre-1.0. The upgrade path is to move to the latest release; releases follow Semantic Versioning, so within 0.1.x upgrades are backwards compatible for the documented interfaces.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report vulnerabilities privately using GitHub's private vulnerability reporting:

➡️ https://github.com/jerus-org/jci-coverage/security/advisories/new

(From the repository, use the Security tab → Report a vulnerability.)

Please include as much of the following as you can, so we can reproduce and assess the issue quickly:

• A description of the vulnerability and its potential impact.
• Steps to reproduce, or a proof-of-concept.
• The affected version(s) and your environment (OS, Rust toolchain).
• Any suggested remediation, if you have one.

This is a small, single-maintainer project; timelines are best-effort but we aim to:

We will keep you informed of progress throughout. If you do not receive an acknowledgement within the target window, please re-send via the same channel.

• We follow coordinated disclosure: we ask that you give us reasonable time to release a fix before any public disclosure, and we will coordinate timing with you.
• We will credit reporters for their responsible disclosure in the release notes and/or advisory, unless you ask to remain anonymous.
• Publicly-known fixed vulnerabilities are published in the corresponding GitHub Security Advisory and recorded in the project's release notes (see below).

The project keeps two release logs, and a security fix is made discoverable in both by placing the advisory identifier (GHSA / RUSTSEC / CVE) in the right place:

• CHANGELOG.md (per crate, generated by gen-changelog) — commit the fix using the Conventional Commits type security: with the advisory identifier in the subject, e.g. security: fix path traversal in output writer (GHSA-xxxx-xxxx-xxxx). gen-changelog routes the security and dependency commit types (and chore(deps)) to a dedicated Security section, so the fix is grouped and always shown.
• PRLOG.md (workspace, keyed off pull-request titles) — put the same advisory identifier in the pull-request title, e.g. security: fix path traversal in output writer (GHSA-xxxx-xxxx-xxxx). The PRLOG automation records merged PRs by title, so the disclosure appears in the workspace log.