tui-textarea/SECURITY.md

Security Policy

Supported Versions

Version	Supported
latest	Yes
< latest	No (upgrade to latest)

Reporting a Vulnerability

Please do NOT report security vulnerabilities through public GitHub issues.

Instead, use GitHub Security Advisories to report vulnerabilities privately.

Please include:

1. Description of the vulnerability
2. Steps to reproduce
3. Potential impact
4. Suggested fix, if any

Response Timeline

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Fix and disclosure: Coordinated with reporter, typically within 30 days

Scope

This policy covers the tui-textarea-2 crate and vulnerabilities in its integration with supported terminal backends and optional features. Vulnerabilities in upstream libraries such as Ratatui, Crossterm, Termion, or Termwiz should be reported to their respective maintainers unless the issue is caused by this crate's usage or integration of those libraries.

Security Measures

• Dependency updates are managed via Dependabot
• Dependabot security alerts and security updates are enabled
• All PRs require CI checks for test, clippy, fmt, and MSRV compatibility