Do not open a public GitHub issue for a suspected security problem.

If GitHub offers private vulnerability reporting for this repository, use it. If it does not, ask the maintainers for a private reporting route. Keep that first message free of vulnerability details.

Include as much of the following information as you can:

• The affected version, branch, or commit.
• The platform and OS version.
• The steps to reproduce the problem, or a proof of concept.
• The expected impact.
• Any known mitigations or workarounds.

Kompact is pre-1.0. The latest published release is 0.10.0.

Report problems that affect the latest published release or the current default branch. The maintainers decide case by case whether to fix an older version. Do not expect backported fixes.

Before you publish technical details, give the maintainers time to confirm the problem, prepare a fix, and agree on a disclosure date with you.