Please do not report security vulnerabilities via public GitHub issues.

Use GitHub's built-in private reporting:

1. Go to the Security tab of the affected repository
2. Click "Report a vulnerability"
3. Fill in the details

This keeps the report private and within GitHub, and allows coordinated disclosure.

• Address: [email protected]
• Subject: [SECURITY] <repo-name> — Brief description

What to include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgement: Within 48 hours
• Assessment: Within 1 week
• Fix timeline: Depends on severity — critical issues within 30 days where possible

We follow coordinated disclosure. We ask that you:

1. Give us reasonable time to address the issue before public disclosure
2. Make a good faith effort to avoid privacy violations, data destruction, or service disruption
3. Do not access or modify other users' data

We will credit reporters who follow responsible disclosure practices.