This security policy applies to public projects under the honeycombio organization on GitHub. For security reports involving the services provided at (ui|ui.eu1|api|api.eu1).honeycomb.io, refer to the Honeycomb Bug Bounty Program for scope, expectations, and reporting procedures.

Security and bug fixes are generally provided only for the last minor version. Fixes are released either as part of the next minor version or as an on-demand patch version.

Security fixes are given priority and might be enough to cause a new version to be released.

We encourage responsible disclosure of security vulnerabilities. If you find something suspicious, we encourage and appreciate your report!

In order for the vulnerability reports to reach maintainers as soon as possible, the preferred way is to use the "Report a vulnerability" button under the "Security" tab of the associated GitHub project. This creates a private communication channel between the reporter and the maintainers.

If you are absolutely unable to or have strong reasons not to use GitHub's vulnerability reporting workflow, please reach out to the Honeycomb security team at security@honeycomb.io.