mirror of
https://github.com/lvgl/lvgl.git
synced 2026-08-17 09:42:19 +08:00
36 lines
1.2 KiB
Markdown
36 lines
1.2 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a vulnerability
|
|
|
|
**Please do not open a public GitHub issue for security problems.**
|
|
|
|
Report suspected vulnerabilities privately by email to
|
|
**security@lvgl.io**.
|
|
|
|
Please include, as far as you can:
|
|
|
|
- the affected version(s) and configuration (`lv_conf.h` toggles, target),
|
|
- a description of the impact,
|
|
- steps to reproduce or a proof of concept, and
|
|
- any suggested fix or mitigation.
|
|
|
|
We support coordinated disclosure: please give us a reasonable window to
|
|
release a fix before any public disclosure. We will credit you in the advisory
|
|
unless you prefer otherwise.
|
|
|
|
## Supported versions
|
|
|
|
Fixes are made available for the actively supported releases. See the
|
|
[Policies page](https://docs.lvgl.io/master/introduction/policies) for the
|
|
current support table.
|
|
|
|
## SBOM and more
|
|
|
|
LVGL publishes a machine-readable SBOM (SPDX 3.0.1) in the [`sbom/`](sbom/)
|
|
folder and a human-readable component list in
|
|
[`COPYRIGHTS.md`](COPYRIGHTS.md).
|
|
|
|
For our full security commitment, vulnerability handling process, and how LVGL
|
|
supports users' EU Cyber Resilience Act (CRA) obligations, see the
|
|
[Security page in the documentation](https://docs.lvgl.io/master/introduction/security).
|