Thank you for helping keep this project and its users safe.
We aim to provide security updates for the latest released minor version. Older versions may receive fixes on a best‑effort basis.
Please report security issues responsibly. Do not create public GitHub issues for sensitive reports.
Preferred reporting methods:
- Private Vulnerability Reporting (recommended):
- If enabled for this repository, use the "Report a vulnerability" button on GitHub (Security tab → Private vulnerability reporting). This sends a private report to the maintainers.
- Email (fallback):
- If the button above is not available, email: REPLACE_WITH_SECURITY_EMAIL
- Please include steps to reproduce, affected versions/commit, and any PoC you can share.
We will make a best effort to acknowledge your report within 2 business days and provide an initial assessment within 7 business days. We will keep you informed about the fix progress and coordinate a disclosure timeline with you.
- Application source code in this repository, including build scripts and configuration.
- Please do not test against live users without explicit permission. Avoid data exfiltration; use minimal proof‑of‑concepts.
- We prefer coordinated disclosure: we will work with you on a fix and publish advisories (GHSA) when updates are available.
- If a vulnerability is found to impact downstream users, we will issue a GitHub Security Advisory and, when possible, provide mitigation guidance.
If you would like to encrypt your message, you can optionally send a GPG‑encrypted report using your own key exchange process. Maintainers will provide a public key upon request.
We appreciate your efforts to improve the security of this project.