Splic is under active development. Security updates will be prioritized for the latest available release.

If you discover a security vulnerability in Splic, please report it responsibly.

• Do not disclose the vulnerability publicly before it has been investigated.
• Do not open a public GitHub issue containing vulnerability details, exploit code, credentials, or sensitive information.
• Provide a clear description of the vulnerability, its potential impact, and reproduction steps where possible.

Please use GitHub's Private Vulnerability Reporting feature, if enabled for this repository, to submit your report privately.

If private reporting is unavailable, contact the repository maintainers through an appropriate private channel before disclosing the issue publicly.

We will make reasonable efforts to acknowledge reports, investigate valid vulnerabilities, and communicate relevant updates.

Response and remediation timelines may vary depending on the severity and complexity of the issue.

Please allow maintainers reasonable time to investigate and address a vulnerability before public disclosure.

This policy covers security vulnerabilities affecting Splic and its associated codebase.

Reports should focus on genuine security risks. General bugs, feature requests, and non-security issues should be reported through the appropriate project channels.