Security Policy
How to report a vulnerability in the mc compiler or in this registry, what happens next, and how long it takes. Reports are welcome and are answered by a person.
1. Where to report
security@minicompiler.dev, in English or in Portuguese. Please do not open a public issue for a vulnerability, and please do not post it on the package pages.
If you cannot use e-mail, open a private security advisory on the affected repository in the
minicompiler organisation on GitHub.
2. Scope
In scope:
minicompiler.dev,pkg.minicompiler.devand the server behind them (mcweb, the validation worker, the registry index);- the mc compiler and toolchain -- including the sandbox, the object writers and the package client;
- the published packages' infrastructure: the archive addresses, the hashes and the index the registry serves.
Out of scope:
- a vulnerability in a third party's package -- report it to its maintainer, and tell us if the maintainer does not answer (package policy);
- denial of service by volume, load testing, and anything that degrades the service for other users;
- social engineering of the operator or of any user, and physical attacks;
- reports generated by an automated scanner with no demonstrated impact, missing hardening headers with no exploit path, and issues in third-party services (GitHub, the hosting provider, the CDN) that are not ours to fix.
3. What to put in a report
- what the issue is, and what an attacker gets from it;
- the exact steps, request or source file that reproduces it -- a minimal
.mcprogram, a raw HTTP request, or a command line is ideal; - the version: the compiler's
mc --version, or the date and time of the request to the site; - how you would like to be credited, if you want to be.
4. What happens, and when
| Step | Target |
|---|---|
| Acknowledgement of your report | 3 business days |
| First assessment: is it a vulnerability, and how serious | 10 business days |
| Fix for a critical issue in the service | as fast as it can be deployed, usually the same day |
| Fix for an issue in the compiler or the toolchain | in the next release; a critical one gets a release of its own |
| Public disclosure, coordinated with you | after the fix, or 90 days after the report, whichever comes first |
These are targets for a service run by one person without charge. If an issue is being exploited, say so in the first line of your message and the timelines above stop applying: it is handled at once.
5. Safe harbour
If you research in good faith, follow this policy, stay within the scope above, and neither degrade the service nor access, modify or keep data that is not yours, the operator will not pursue legal action against you and will treat your work as authorised. Stop as soon as you have a proof of concept: one request that shows the flaw is enough, and a dump of somebody's data is never necessary. Report what you found, do not disclose it publicly before the coordinated date, and delete anything you retrieved.
This promise is the operator's alone. It cannot bind GitHub, the hosting provider or any other third party, and it does not cover conduct that is criminal irrespective of intent.
6. Rewards
There is no bug bounty: this is a free service run by one person. Credit is given on the release notes and on the advisory, in whatever form you prefer, including none.
7. Advisories
A fix that matters to users is announced in the release notes of the affected component, and, when a published package is affected, as an advisory attached to its versions and shown on its package page and in the registry index.
8. What this service does to protect you
The measures in force are listed in the privacy policy, section 8: TLS everywhere, a strict content security policy, hashed session tokens, constant-time comparison of secrets, bound parameters for every database value, one short-lived process per request, and validation of every published package inside a sandbox with no network. None of that makes a package safe to run; read what validation proves.
Change log
- 2026-09-06 -- first version, effective from the day the login opened.