Skip to content

Security: nttcom/gharf

Security

SECURITY.md

Security Policy

Abuse Report

We provide a point of contact for reporting potential abuse or inappropriate use of GHARF. When releasing GHARF, we considered the potential risks of misuse and ask for your cooperation in sharing relevant information should such situations arise.

Contact

Please send your report to the following email address:

📧 gharf-dev [at] ntt.com
(Please replace [at] with @ when sending the email.)

Please note that we are not currently accepting reports via issues or pull requests. Do not include any personal or confidential information in your message.

Response Policy

Submitted reports will be reviewed, and the project team may consider taking appropriate action at their discretion if necessary. Possible actions may include:

  • Temporary or permanent suspension of public access
  • Modification or restriction of specific functionality
  • Updates to documentation for clarification or warning

Please note that we do not guarantee a response or resolution for all reports.

What to Report

We encourage you to report if you suspect GHARF is being used in an unintended or inappropriate way, such as:

  • GHARF workflows are being executed without the awareness or consent of the affected party
  • Artifacts generated by GHARF (e.g., binaries) are found being used or distributed in unexpected environments
  • The use of GHARF appears to have unintended impact on third parties

Even if your case does not fall into the categories above, we welcome reports of any other suspected misuse or concerning behavior related to GHARF.

Information to Include

When submitting a report, the following information will help us better understand the situation:

  • Summary of the issue
    • A description of the observed behavior or impact, to the extent you are able to provide.
  • Why you believe GHARF is involved
    • Any context or reasoning that suggests the incident is related to this framework.

You do not need to provide detailed logs or network information.

There aren't any published security advisories