Whisker is a community-maintained open-source project. We take security bugs seriously and welcome responsible disclosure from security researchers worldwide.

• Please do not open a public GitHub issue for security vulnerabilities.
• Open a private security advisory on this repository, or contact the maintainers through the repository owner's profile.

• A clear description of the issue and its impact.
• Steps or a proof-of-concept to reproduce.
• Affected version/commit.

Please do not perform testing against any production service. Run a self-hosted instance locally for all tests.

1. We acknowledge reports as soon as possible.
2. We investigate, fix promptly, and release a patch.
3. Credit is given to reporters in the release notes (unless anonymity is requested).

Thank you for keeping Whisker and our users safe. 🐾