Security fixes are applied to the default branch and to the latest release line when a release line exists.

Do not report security vulnerabilities in a public GitHub issue.

Use GitHub's private vulnerability reporting feature or the private contact mechanism associated with this repository. Include:

• A concise description of the vulnerability.
• The affected file, component, or workflow.
• Reproduction steps or a minimal proof of concept.
• Expected and observed behavior.
• Potential impact.
• Suggested mitigation, if known.

Remove credentials, personal information, and unrelated private data from the report.

Maintainers will acknowledge receipt as promptly as practical, validate the report, assess impact, and coordinate remediation. Public disclosure should occur only after an appropriate fix or mitigation is available and maintainers have agreed on timing.

This policy covers the Traceboard repository, its documented development workflow, and code shipped from this repository. Third-party services and infrastructure may have separate reporting policies.