This is the default policy for Allsrc repositories. A repository with its own SECURITY.md follows that one instead.

Please do not open a public issue for a security problem.

Report it privately through GitHub: open the affected repository's Security tab and choose Report a vulnerability. Include what you found, how to reproduce it, the version or commit, and what an attacker could do with it.

You can expect an acknowledgement within a few days. Fixes are developed in a private advisory, released, and then disclosed with credit to the reporter unless you prefer otherwise. These are volunteer-maintained projects, so please allow reasonable time.

Unless a repository says otherwise, only the latest published release receives security fixes. Projects that are pre-1.0 may change interfaces between minor versions.

Vulnerabilities in third-party software the project integrates with, denial of service caused by an administrator's own configuration, and issues that require an attacker who already has server or database access.