| # Security Policy | |
| Mypy team members balance security work against many | |
| other responsibilities. Please be thoughtful about the time and attention your | |
| report requires. Repeated failure to respect this will result in future reports | |
| being rejected, or the reporter being banned from the `python` GitHub organization, | |
| regardless of technical merit. | |
| ## Reporting a Vulnerability | |
| Submit a vulnerability report using GitHub Security Advisories. | |
| Reports should be a few sentences describing the vulnerability. Ideally include | |
| a proof-of-concept script that reproduces the issue and provides a clear | |
| indication of whether the vulnerability is still present. Reports must be | |
| plain-text only, including attachments. No PDFs, binaries, notebooks, or other | |
| files that cannot be safely reviewed. If your proof-of-concept depends on a | |
| specially constructed binary file, please include a script to construct it | |
| rather than the file itself. Ideally, include a minimal patch with the mitigation | |
| for the report. | |
| Reports that do not contain a potential security vulnerability (such as spam or | |
| requesting compliance or due-diligence work) will be discarded without a reply. |