Please report suspected vulnerabilities privately. Do not include exploit details, credentials, personal information or client data in public issues or pull requests.

Use Security → Advisories → Report a vulnerability in the affected repository when available. If that route is unavailable, use the central private reporting form and identify the affected repository. Do not include live credentials or personal data.

Include reproduction steps using a test environment, expected and actual behavior, impact, and any proposed fix. Use synthetic examples and redact secrets. Do not access others' data, disrupt services or test systems without authorization.

Follow the affected project's documented support policy. Where no release support table exists, maintainers assess reports against the current default branch and latest release; this does not promise maintenance of older versions. Upstream projects may have separate reporting and support policies.

Maintainers assess scope and impact, coordinate remediation and discuss disclosure timing with the reporter. Security fixes may be developed privately before a public advisory or release. We do not promise a fixed response time, bounty or legal authorization to test third-party systems.