Please do not open public issues or pull requests for security vulnerabilities.

Report vulnerabilities privately by email to security@sendtrap.dev. Include a description of the issue, a proof of concept if you have one, and the affected version(s).

You will receive an acknowledgement within 3 business days. We aim to ship a fix (or a documented mitigation) within 90 days of a confirmed report, coordinating the disclosure date with you.

During the 0.x series, only the latest published 0.x minor receives security fixes, released as a new patch version. There is no long-term support branch before 1.0.

Security fixes in sendtrap/core ship publicly with synchronized upgrades of the downstream Sendtrap distributions that consume this package. Advisories credit reporters unless they prefer otherwise.