meta is a data repository — curated project entries, a JSON Schema, and the workflow that assembles them into the projects.json served to kirch.dev. It is not a published package.
The supported "version" is always the tip of main. Nothing here is consumed by version, so there are no historical branches to back-port fixes to.
Please do not file a public GitHub issue for security problems.
In the context of this repository, a "vulnerability" typically means:
- An insecure default in a shipped workflow (e.g. overly broad
permissions). - A misconfigured Action that could leak secrets, or a change that would make the sync read private repository data.
- A dependency in
package.jsonthat introduces a known CVE.
Use one of the following private channels:
- GitHub Private Vulnerability Reporting (preferred): open a private advisory at https://github.com/kirchDev/meta/security/advisories/new.
- Email: titus.kirch@kirch.dev. PGP available on request.
Please include:
- A description of the vulnerability and its impact on downstream repositories.
- Steps to reproduce.
- Any suggested fix, if you have one.
| Stage | Target timeline |
|---|---|
| Acknowledgement of report | within 3 business days |
| Initial assessment & triage | within 7 business days |
| Patch released (if accepted) | depends on severity — critical issues prioritised |
| Public disclosure & advisory | coordinated with reporter after the patch ships |
Reporters who follow this process responsibly are credited in the CHANGELOG and the corresponding GitHub Security Advisory, unless they prefer to remain anonymous.
Maintained by Titus Kirch / IT-Dienstleistungen Titus Kirch.