Maintenance policy#

Pain001 is free open-source software maintained in a personal capacity. This page says what to expect from it. It is a statement of intent, not a contract: there is no paid tier, no service level agreement (SLA) and no out-of-hours cover.

Releases#

  • Releases move one step at a time on the 0.0.x line, as described in RELEASING.md. Each release is a signed tag with build provenance, attestations, an SBOM and SHA-256 checksums of every asset; verify a release shows how to check them.

  • The support table in SUPPORT.md lists the versions that currently receive fixes.

Long-term support#

  • There is no long-term support (LTS) line at present.

  • Fixes, including security fixes, ship in the next release; you get them by upgrading. Earlier releases are not patched.

  • If an LTS line is offered later, this page will name the release and how long it is supported before that applies.

Security reports#

  • Report vulnerabilities privately, as SECURITY.md describes.

  • The goal is to acknowledge a report within 5 working days. This is a goal, not a guarantee.

What this policy does not offer#

  • No SLA, no guaranteed response or fix times, no out-of-hours cover.

  • No paid support, sponsorship or partner programme. Pain001’s licence lets any firm support it commercially; the project has no commercial partners and takes no fees or referrals.

  • No certification. Pain001 publishes evidence (see Evidence for reviewers); it does not claim compliance with any regulation or standard.