Please do not open a public GitHub issue for security vulnerabilities.

Instead, email oss@jwprotect.com with:

• A description of the vulnerability and its potential impact.
• Steps to reproduce, or a proof of concept if you have one.
• The version/commit you tested against.

• We will acknowledge your report within a reasonable time and aim to respond with an initial assessment as soon as we can.
• This project is maintained by a small team without a dedicated security team or bug bounty program, so response times may vary.
• We ask that you give us a reasonable amount of time to address a confirmed issue before any public disclosure.

This policy covers the code in this repository (the self-hosted edition). It does not cover the hosted service at jwprotect.com, which should be reported to the same address with "jwprotect.com" noted in the subject.

This project has not yet made a tagged release. Until a versioning scheme is established, please report issues against the latest commit on main.