Skip to content

Maintainer Policy

Responsibilities

Maintainers keep the project releaseable, private by default, and honest about hardware coverage. That includes:

  • protecting the read-only probe contract
  • reviewing privacy impact for logs, support bundles, fixtures, and docs
  • keeping CI, schema validation, and supply-chain checks required for releases
  • documenting known limitations before release
  • preserving the stable 1.x CLI and JSON contracts

Review Rules

Changes should receive extra scrutiny when they touch:

  • command execution
  • support bundle collection
  • redaction
  • JSON schema fields
  • finding IDs, impacts, or exit-code mapping
  • installer or release artifact verification
  • Debian, Homebrew, or APT packaging

Security Handling

Security reports are handled privately through GitHub Security Advisories. Maintainers should avoid asking reporters to post sensitive logs or bundles in public issues.

Confirmed vulnerabilities need:

  • a fix
  • a regression test where practical
  • a release-notes entry
  • advisory publication when the fix is released

Release Authority

Only maintainers should publish final release artifacts or package-channel updates. Release candidates may be used for validation, but they should not be promoted to Debian mentors, Homebrew, or APT channels as stable artifacts.