Security policy

Report a security problem

Report security problems privately. Do not create a public issue for a problem that someone could exploit.

• Use the security report form; or
• use GitHub private vulnerability reporting on the repository.

Include steps to reproduce the problem and explain what an attacker could do. Expect an acknowledgment within one week. This is a part-time solo project, so the most serious reports receive priority.

Supported version

PWMSim is in technical alpha. Only the current hosted browser version is supported.

What counts as a security problem

• Imported netlists and calculations are untrusted. They must not be able to run arbitrary code, bypass validation, or use unlimited memory.
• Simulations stay in the browser. Any path that sends circuit data outside the browser is a security problem, including a path into anonymous usage reporting.
• Share links use the URL fragment. Browsers do not send that part of the URL to a server. Putting circuit data where a server can read it is a security problem.
• The contact form is the site's only write action. It must only accept same-site form posts and the listed topics. It must not allow header injection, send to an address chosen by the submitter, or become an open email sender.

Wrong simulation results

A silent wrong answer can be more harmful than a crash. Confirmed wrong answers for supported features follow the correctness policy: a public issue, a tested fix or a clear change to the supported limits, and a published report.

Scope

Security reports about hosting, DNS, or email for pwmsim.com are welcome. Automated scan results without a clear impact are not. A missing security header on a page that handles no data is also outside this policy.