Security & coordinated disclosure
Private reports.
Deliberate disclosure.
Report vulnerabilities privately, never in public issues.
Report problems privately through GitHub’s private vulnerability reporting: for the Geometer app, the geo command and the container image at GeometerLabs/geometer, and for the open verifier and schemas at GeometerLabs/geometer-verify. We reply in the advisory. The address [email protected] is not yet confirmed, so GitHub is the reliable route.
Supported scope
The existing product security policy supports the latest stable release and the immediately previous stable minor. Public release availability is listed on Downloads. A local implementation is not automatically a supported shipped release.
Severity and policy targets
The repository policy uses CVSS 4.0, with fix/mitigation targets of 7 days for critical, 30 days for high, 90 days for medium, and the next release for low severity. These are the source policy’s targets, not newly verified response guarantees from this website.
What to include
Send the affected version, a minimal description and a permitted isolated reproduction. Do not include customer secrets, payment credentials or unrelated personal data.
Authorization and disclosure
Testing must stay within authorized environments. A public code license is not permission to attack unrelated live deployments. Do not auto-publish unresolved problems. Coordinate maintainer notification, remediation, recheck and any agreed publication.
Compromised artifacts
The release policy allows withdrawal of a channel entry and publication of a revoked artifact digest in the signed release manifest. Advisories should identify affected ranges, mitigation, fixed versions and replay limits.
Open-source audits & rewards
No funded bug bounty is active. Our planned open-source audits will use permitted, isolated environments and coordinated disclosure. See the case study and certificate plan for the intended public output. No third-party project is enrolled through this site yet.