Skip to content

SECURITY.md

Latest commit

 

History

History
45 lines (30 loc) · 1.71 KB

SECURITY.md

File metadata and controls

45 lines (30 loc) · 1.71 KB

Security policy

Do not open a public GitHub Issue, Discussion, or pull request to report a security vulnerability. Public disclosure before a fix is available puts all Lore users at risk.

Reporting a vulnerability

Report through Epic Games' security channels:

Use the subject line "Lore Python SDK security" when reporting by email.

Safe harbor

Epic doesn't pursue legal action against researchers acting in good faith under this policy.

What to include

  • A description of the vulnerability and how it can be exploited
  • Step-by-step reproduction, or a minimal reproduction program
  • The affected SDK version (run pip show lore-py)
  • Your Python version, OS, and CPU architecture
  • Impact assessment — what can an attacker do?
  • Your name and affiliation for credit (or note if you prefer anonymity)

Scope

This file covers the lore-py Python package and its published platform binaries. Vulnerabilities in the underlying Lore wire protocol, lore-capi, or loreserver are also in scope — mention which component is affected.

Response, disclosure, supported versions, and bug bounty

The full response timeline, embargo tracks, supported-version policy, CVE coordination, and bug bounty terms are governed by the Lore project security policy and apply uniformly to the SDK:

→ Lore SECURITY.md

If you do not receive an acknowledgement within 7 days, follow up at security@epicgames.com with "Lore Python SDK security" in the subject line.