[{"data":1,"prerenderedAt":307},["ShallowReactive",2],{"content-pages-path=\u002Fopensource\u002Fsecurity-policy":3,"content-pages-surroundings-path=\u002Fopensource\u002Fsecurity-policy":188,"content-pages-navigation":199},{"id":4,"title":5,"body":6,"description":165,"display":166,"extension":171,"meta":172,"navigation":173,"ogImage":175,"path":180,"robots":181,"schemaOrg":182,"seo":183,"sitemap":184,"ssr":185,"stem":186,"__hash__":187},"pages\u002F500.opensource\u002F003.security-policy.md","安全策略",{"type":7,"value":8,"toc":156},"minimark",[9,13,18,30,33,44,47,61,64,68,71,74,78,89,92,122,126,129,144,147,150,153],[10,11,12],"p",{},"我们非常重视本项目的安全与合规性。\n如果您认为发现了安全与合规漏洞，请以负责任的方式向我们报告。",[14,15,17],"h2",{"id":16},"_1-报告漏洞","1. 报告漏洞",[10,19,20,21,25,26,29],{},"请不要公开创建讨论（",[22,23,24],"code",{},"Issue","）或拉取请求（",[22,27,28],{},"Pull Request","）。",[10,31,32],{},"请发送邮件至：",[34,35,36],"ul",{},[37,38,39],"li",{},[40,41,43],"a",{"href":42},"mailto:security@song-zh.com","security@song-zh.com",[10,45,46],{},"邮件中请包含：",[34,48,49,52,55,58],{},[37,50,51],{},"对问题的清晰描述",[37,53,54],{},"复现步骤",[37,56,57],{},"影响评估（若已知）",[37,59,60],{},"建议的修复方案（可选，但欢迎提供）",[10,62,63],{},"我们将在发布说明中对所有报告者致谢（除非您要求匿名）。",[14,65,67],{"id":66},"_2-受支持版本","2. 受支持版本",[10,69,70],{},"仅每个主要版本线的最新次要版本接收安全更新。",[10,72,73],{},"不受支持的版本将不会获得补丁。请升级到受支持版本。",[14,75,77],{"id":76},"_3-安全标头与最佳实践","3. 安全标头与最佳实践",[10,79,80,81,84,85,88],{},"本项目不强制执行运行时安全策略（例如 ",[22,82,83],{},"CSP","、",[22,86,87],{},"HSTS","）——这些属于部署环境的责任。",[10,90,91],{},"建议开发者：",[34,93,94,101,115],{},[37,95,96,97,100],{},"保持依赖项更新（使用 ",[22,98,99],{},"dependabot"," 或类似工具）",[37,102,103,104,84,107,110,111,114],{},"使用 ",[22,105,106],{},"trivy",[22,108,109],{},"snyk"," 或 ",[22,112,113],{},"osv-scanner"," 等工具扫描漏洞",[37,116,117,118,121],{},"在集成本软件时遵循 ",[22,119,120],{},"OWASP Top 10"," 指南",[14,123,125],{"id":124},"_4-法律声明","4. 法律声明",[10,127,128],{},"报告漏洞并不授予您以下权限：",[34,130,131,134,141],{},[37,132,133],{},"在协调之前公开披露",[37,135,136,137,140],{},"在概念验证（",[22,138,139],{},"PoC","）之外，进一步利用该漏洞（禁止数据窃取、拒绝服务攻击等）",[37,142,143],{},"要求补偿（我们是一个开源项目）",[10,145,146],{},"滥用报告的漏洞可能违反法律条款及适用法律。",[10,148,149],{},"请参阅：开源许可文件以了解合法使用和责任免责声明。",[151,152],"hr",{},[10,154,155],{},"感谢您帮助使本项目更加安全。",{"title":157,"searchDepth":158,"depth":158,"links":159},"",4,[160,162,163,164],{"id":16,"depth":161,"text":17},2,{"id":66,"depth":161,"text":67},{"id":76,"depth":161,"text":77},{"id":124,"depth":161,"text":125},"这份策略明确了安全漏洞的举报流程、响应机制与披露原则，以最严谨的态度守护项目的稳定性。",{"style":167,"layout":169,"ui":170},[168],"site:[&>*]:text-justify","default",{},"md",{},{"type":174},"page",{"type":176,"component":177,"width":178,"height":179},"Component","WebsiteLogo",1200,600,"\u002Fopensource\u002Fsecurity-policy",true,null,{"title":5,"description":165},{"loc":180},{},"500.opensource\u002F003.security-policy","SSyUZonRtH0j0nKOChPeTEevb19xnzhjoRh6bEsxmSo",[189,194],{"title":190,"path":191,"stem":192,"description":193,"type":174,"children":-1},"MIT 许可证","\u002Fopensource\u002Fmit-license","500.opensource\u002F002.mit-license","本许可证以最简洁的文字，赋予代码最广阔的边界——允许复用、修改、甚至商业化，唯一的约定是保留署名的尊重。",{"title":195,"path":196,"stem":197,"description":198,"type":174,"children":-1},"行为准则","\u002Fopensource\u002Fcode-of-conduct","500.opensource\u002F004.code-of-conduct","这份准则是我们对“开放与尊重”的共同承诺——它定义了友善的边界，也守护着社区的包容性。",[200,206,212,218,224,230,239,267,295,301],{"title":201,"path":202,"stem":203,"description":204,"navigation":205,"type":174},"首页","\u002F","001.index","宋子桓的个人介绍，包括个人情况、技术信念、技术栈和领域、精选作品和联系方式等。",{"type":174},{"title":207,"path":208,"stem":209,"description":210,"navigation":211,"type":174},"宋子桓","\u002Fprofile","002.profile","宋子桓的个人介绍，包括简介、技术信念、技术栈等多方面。",{"type":174},{"title":213,"path":214,"stem":215,"description":216,"navigation":217,"type":174},"主要作品","\u002Fprojects","003.projects","宋子桓的主要作品合集，包含作品介绍、分类、地址等信息。",{"type":174},{"title":219,"path":220,"stem":221,"description":222,"navigation":223,"type":174},"联系方式","\u002Fcontact","004.contact","欢迎通过邮件或社交网络与我们联系。",{"type":174},{"title":225,"path":226,"stem":227,"description":228,"navigation":229,"type":174},"最新动态","\u002Fnews","005.news","关于宋子桓的最新动态。",{"type":174},{"title":231,"path":232,"stem":233,"children":234,"description":157,"navigation":238,"type":174},"博客","\u002Fblogs","100.blogs\u002F001.index",[235],{"title":231,"path":232,"stem":233,"description":236,"navigation":237,"type":174},"宋子桓的技术沉淀和博文。",{"type":174},{"type":174},{"title":240,"path":241,"stem":242,"children":243,"description":157,"navigation":266,"type":174},"开源","\u002Fopensource","500.opensource\u002F001.index",[244,248,250,252,254,260],{"title":245,"path":241,"stem":242,"description":246,"navigation":247,"type":174},"开源策略","这里记录了我们开源理念与协作边界，也为你提供了包含开源许可证在内的关键文档及其介绍的入口。",{"type":174},{"title":190,"path":191,"stem":192,"description":193,"navigation":249,"type":174},{"type":174},{"title":5,"path":180,"stem":186,"description":165,"navigation":251,"type":174},{"type":174},{"title":195,"path":196,"stem":197,"description":198,"navigation":253,"type":174},{"type":174},{"title":255,"path":256,"stem":257,"description":258,"navigation":259,"type":174},"常见问题","\u002Fopensource\u002Ffaq","500.opensource\u002F005.faq","本列表记录了关于开源策略的常见问题和解答。",{"type":174},{"title":261,"path":262,"stem":263,"description":264,"navigation":265,"type":174},"赞赏我们","\u002Fopensource\u002Fdonate","500.opensource\u002F006.donate","若我们的代码曾为你解决难题，这份支持会成为我们继续探索边界的动力。",{"type":174},{"type":174},{"title":268,"path":269,"stem":270,"children":271,"description":157,"navigation":294,"type":174},"域名","\u002Fdomain","900.domain\u002F001.index",[272,276,282,288],{"title":273,"path":269,"stem":270,"description":274,"navigation":275,"type":174},"我的域名","宋子桓持有的域名的 RDAP 信息，包含：注册商、创建时间、过期时间、域名状态、名称服务器（NS）记录。",{"type":174},{"title":277,"path":278,"stem":279,"description":280,"navigation":281,"type":174},"SONG-ZH.COM","\u002Fdomain\u002Fsong-zh-com","900.domain\u002F002.song-zh-com","查询 SONG-ZH.COM 的注册信息，包含：注册商、创建时间、过期时间、域名状态、名称服务器（NS）记录。",{"type":174},{"title":283,"path":284,"stem":285,"description":286,"navigation":287,"type":174},"SONGZIHUAN.COM","\u002Fdomain\u002Fsongzihuan-com","900.domain\u002F003.songzihuan-com","查询 SONGZIHUAN.COM 的注册信息，包含：注册商、创建时间、过期时间、域名状态、名称服务器（NS）记录。",{"type":174},{"title":289,"path":290,"stem":291,"description":292,"navigation":293,"type":174},"SONGZIHUAN.CN","\u002Fdomain\u002Fsongzihuan-cn","900.domain\u002F004.songzihuan-cn","查询 SONGZIHUAN.CN 的注册信息，但暂时还无法提供 RDAP 的查询结果。",{"type":174},{"type":174},{"title":296,"path":297,"stem":298,"description":299,"navigation":300,"type":174},"关于本站","\u002Fabout","950.about","本站的元信息档案：包含网站名称、域名所有权、作者、联系方式、网站备案号等信息，还有技术人关心的版本号等数据。",{"type":174},{"title":302,"path":303,"stem":304,"description":305,"navigation":306,"type":174},"全站导航","\u002Fsitemap","990.sitemap","本站专栏导航：包含「博客」「最新动态」「开源」等专栏。点击任意专栏，一键直达专栏首页。",{"type":174},1785785845027]