This file is the org default, for repos without their own policy. A repo policy, if it exists, wins over this file.

Only the latest release, of each repo, gets security fixes. Older releases get no backport, unless a maintainer says otherwise. Report a flaw in an old release, and note the version clearly.

Do not open a public issue, for a security flaw. Use GitHub private vulnerability reporting, on the affected repo, if it is on. Or use the contact form, at https://infralicious.com/contact.html Describe the flaw, the affected version, and the impact. Include steps to reproduce, if you can do so safely. Do not exploit the flaw, beyond what proves it exists. Do not share the flaw, until a fix is public.

A maintainer will confirm the report, and set a fix plan. Fixes ship in a new release, with a short advisory. Credit goes to the reporter, if the reporter wants credit. No reward program exists today, credit is the only offer.

No email address is published here, on purpose. Use the contact form, or private vulnerability reporting, above. Do not send secrets, passwords, or tokens, in a report. If a report contains a secret, rotate that secret at once.