Report a vulnerability privately through GitHub: open the repository's Security tab and choose Report a vulnerability (https://github.com/probityai/probity/security/advisories/new). Please do not open a public issue for it.

The most useful report is the input and the verdict: evidence, a claim or a record that a tool here accepts and should refuse, or refuses and should accept. Say which package and version you ran.

You get an acknowledgement within three working days. A confirmed issue gets a fix, a patch release of the affected package and a GitHub security advisory, and the advisory credits the reporter unless they ask not to be named.

Fixes land on the newest release of each package. Until a package reaches 1.0, a security fix that needs an API change ships as a new minor version of that package.