Security

Report vulnerabilities by email to security@inertiax.dev, not in public issues, forums or social media.

This covers the InertiaX Composer and npm packages, and inertiax.dev and its subdomains. Out of scope: third-party services InertiaX uses (report those to their vendor), denial-of-service testing, and scanner output without a demonstrated impact.

What to include

• the affected package and version, or the affected URL;
• steps to reproduce, with a minimal Table definition or proof of concept;
• the impact: what an attacker could read, change or do.

Leave out credentials, tokens and real user data.

After you report

You get a reply by email, and updates until the report is resolved. For a package vulnerability, the changelog names the fixed versions and, if you want, credits you. Keep the details private until the fix is released, or until a disclosure date is agreed by email.

Supported versions

Security fixes ship as new releases of maintained versions. Before 1.0, only the latest 0.x release is maintained: update to it to get fixes. From 1.0, the previous major also gets security fixes for a limited time after a new major ships; see the component’s support policy, for example Table versions and support.

Test responsibly

Use your own installation and accounts. Do not access other people’s data or disrupt InertiaX services.