Please do not report suspected vulnerabilities in a public issue, pull request, discussion, or by attaching a private document. Use GitHub's private vulnerability reporting or Security Advisories for this repository:

https://github.com/razibit/ilovemd/security/advisories/new

If that private-reporting page is unavailable, do not disclose the details publicly. Repository maintainers must enable GitHub private vulnerability reporting or publish a maintainer-controlled security contact before accepting confidential reports through another route.

When possible, include the affected version or commit, a clear description, reproduction steps or a minimal proof of concept, impact, and any suggested mitigation. Remove credentials, personal data, and document contents that are not necessary to reproduce the issue.

This policy covers security vulnerabilities in iLoveMd source code and its documented deployment configuration. Third-party dependency vulnerabilities should include the affected dependency and version.

Maintainers will acknowledge and investigate valid private reports, coordinate disclosure with the reporter when appropriate, and publish fixes or advisories at their discretion. The project does not currently promise response times, a severity SLA, or CVE assignment.

There is no formal supported-version policy yet. Report vulnerabilities against the current repository state and identify the version or commit you tested.