Skip to content

Security: zhom/donutbrowser

Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting Security Issues

Thanks for helping keep Donut Browser safe.

I take the security of Donut Browser seriously. If you believe you have found a security vulnerability, report it to me through coordinated disclosure.

Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, send an email to contact@donutbrowser.com with the subject line "Security Vulnerability Report".

Include as much of the following as you can:

  • The type of issue (e.g., buffer overflow, injection attack, privilege escalation, or cross-site scripting)
  • Full paths of source file(s) related to the manifestation of the issue
  • The location of the affected source code (tag/branch/commit or direct URL)
  • Any special configuration required to reproduce the issue
  • Step-by-step instructions to reproduce the issue
  • Proof-of-concept or exploit code (if possible)
  • Impact of the issue, including how an attacker might exploit the issue
  • Your assessment of the severity level

This helps me triage your report faster.

AI-Assisted Reports

Use AI to find vulnerabilities. Fuzzing, static analysis, a model reading the code: all fine, and some of it works well.

The report itself has to be written by a human, and verified by that human. Before sending, confirm the vulnerability exists in the current code, at the paths you cite, and that you can reproduce it. An unverified model-written report is not a security report; it will be closed without analysis.

Say in your email whether AI was involved and what it did. That disclosure is never held against you. Omitting it is what ends the conversation.

What to Expect

  • Response Time: I will acknowledge receipt of your vulnerability report within 72 hours.
  • Investigation: I will investigate the issue and send you updates on my progress.
  • Resolution: I aim to resolve critical security issues as fast as possible, and no later than 30 days after the initial report.
  • Disclosure: I will coordinate with you on the timing of any public disclosure.

Contact

For urgent security matters, contact me at contact@donutbrowser.com.

For general questions about this security policy, you can also reach out through:

There aren't any published security advisories