Thank you for helping keep Accelerate and our users safe.

For every officially backed Club project, the current main branch and the most recent tagged release are supported. Older tags may receive security fixes on a best-effort basis.

Please do not open a public GitHub issue for security vulnerabilities. Instead, use one of the private channels below:

Go to the affected repository → Security tab → Report a vulnerability. This creates a private advisory only visible to repo maintainers, and lets us collaborate on a fix without exposing details.

Email accelerate.muj@gmail.com with:

• A description of the vulnerability
• Steps to reproduce
• The affected repository and (if applicable) commit or version
• Your assessment of impact (data exposure, code execution, etc.)
• Whether you have already disclosed the vulnerability elsewhere

We will acknowledge receipt within 72 hours.

1. Acknowledgement within 72 hours
2. An initial assessment within 7 days — we'll tell you our understanding of the severity and our tentative fix timeline
3. A fix and disclosure plan agreed with the reporter — we aim to publish a fix within 30 days for serious issues, faster where feasible
4. Public disclosure and CVE assignment (if applicable) coordinated with the reporter
5. Credit in the advisory and release notes — unless the reporter prefers anonymity

In scope:

• Any code in a repository under github.com/accelerate-muj/
• Any Club-hosted service (websites, bots, applications)

Out of scope:

• Third-party dependencies (report those directly to the dependency's maintainers; we will update once a patched version is released)
• Social-engineering attacks against Club members
• Physical attacks against Club infrastructure or venues
• Vulnerabilities in the personal accounts of Club members

We treat vulnerability research conducted in good faith as an authorised activity. We will not pursue legal action against researchers who:

• Follow the reporting process above
• Do not exploit the vulnerability beyond what is necessary to demonstrate it
• Do not access, modify, or destroy data that does not belong to them
• Do not disrupt Club or University services
• Give us a reasonable window to fix the issue before public disclosure

If a data breach affects Club member data, the Executive Board will notify affected members and the Faculty Coordinator within 72 hours of becoming aware, and will take appropriate remedial and preventive action.