This document defines the security policy and vulnerability disclosure process for the W2UOS project.
Security updates are provided only for the latest stable version of W2UOS on the main branch.
Older snapshots, forks, and experimental branches are not guaranteed to receive security patches.
If you discover a security vulnerability in W2UOS:
- Do NOT open a public GitHub issue.
- Do NOT disclose the vulnerability publicly.
- Report the issue privately to the project author via GitHub.
The report should include:
- A clear description of the vulnerability
- Steps to reproduce
- Affected modules or components
- Potential impact and severity
- Suggested mitigation (if available)
After receiving a vulnerability report:
- The author will acknowledge receipt.
- The issue will be investigated.
- A patch or mitigation will be developed.
- A security update will be released.
- Public disclosure may occur after a fix is available.
Response time depends on the severity and complexity of the issue.
The security policy applies to:
- Core runtime and kernel
- Message bus and networking layers
- Execution engine and exchange adapters
- API and authentication system
- Logging and persistence layers
- Dashboard communication interfaces
User strategies, third-party plugins, and external exchange services are outside the scope of direct security guarantees.
W2UOS is provided as a technical software platform.
The author does NOT provide:
- Financial guarantees
- Trading performance guarantees
- Risk-free operation assurances
All financial risks resulting from the use of W2UOS are solely assumed by the user.
All vulnerability reports must follow responsible disclosure practices.
Public disclosure before an official fix is released is strictly prohibited.
Security reports should be sent privately to:
Author: pb_2n^ (孔穆清)
GitHub: https://github.com/pb2n
Project Repository: https://github.com/pb2n/W2UOS