Publishing guide

Responding to reports

Users can report a plugin from its page here and in Runesmith.

Report	Where it goes	What you do
Broken or doesn't work	An issue in your repository	Answer and fix it as you would any issue. If a problem that breaks Runesmith or loses data goes unanswered for 14 days, users can escalate it to the registry
Breaks the rules	A public issue in the registry	An administrator asks you to fix it within 14 days. Impersonation is acted on immediately
Security	A private report to Runesmith	An administrator contacts you privately

Security reports

Answer within 14 days. Unanswered security reports can cost a plugin its verified status.
Work with the administrator privately on a fix. While it is investigated, new installs may be paused; existing users keep the plugin.
Release the fixed version. The administrator then lifts the pause, or blocks affected versions and publishes an advisory.

Tell Runesmith at once through the security page. An administrator can pause installs of your plugin within minutes while you recover your account.

If you disagree with a moderation decision, open an Appeal issue in the registry. A different administrator answers within seven days.