This policy covers every public repository in the framerslab organization that has no security policy of its own.

Email team@frame.dev. When the repository's Security tab shows a "Report a vulnerability" button, you can report through that form instead. Do not open a public issue, pull request or chat message about a vulnerability.

A maintainer acknowledges a report within 5 business days and sends an assessment and a plan within 14 days.

A fix ships before details are published, and the reporter is credited unless they decline. At 90 days from the report an advisory is published with the fix or, when no fix exists, with mitigations, unless the reporter and a maintainer agree a later date.