Report vulnerabilities in SONIC for A3 privately to this repository's maintainers through GitHub private vulnerability reporting. This entry is also available under Security → Advisories → Report a vulnerability. Do not post vulnerability details, exploit code, credentials, or private robot logs in a public issue.

If the private reporting entry is unavailable, open an issue requesting a private security contact, without including vulnerability details. Wait for the maintainers to provide a private channel before sharing the report.

Include the affected version or commit, impact, and minimal reproduction in the private report. Remove credentials and unrelated personal or robot data.

This A3 adaptation is maintained independently of the upstream GEAR team. For a vulnerability confirmed to affect unmodified upstream SONIC, follow upstream SONIC's security policy. A3-specific vulnerabilities should be reported to this repository's maintainers.

Keep Private vulnerability reporting enabled in the repository security settings and verify that the report entry remains available. See GitHub's setup instructions.