The ASTPP team and community take security seriously. We appreciate responsible disclosure and will work with you to confirm, fix, and publicly credit valid reports.

Please report security issues privately, not through public issues or the community forum. You can report in either of these ways:

• Email: security@astppbilling.org
• GitHub: use "Report a vulnerability" in the Security tab of this repository (private vulnerability reporting).

Full reporting guidelines, scope, and our disclosure process: https://astppbilling.org/security/guideline

• A description of the issue and its impact
• The affected version or commit
• Steps to reproduce, and proof-of-concept material if available
• How you would like to be credited, if the report is valid

• We aim to acknowledge reports within 5 working days.
• We follow a coordinated disclosure process and will agree a timeline with you before any public disclosure.
• We credit reporters in our release notes and security advisories unless you prefer to remain anonymous.
• If a report has not been addressed within 3 months, you are welcome to follow up at security@astppbilling.org.

Please do not publicly disclose an issue until we have released a fix and agreed a disclosure date with you.

Published advisories and CVEs: https://github.com/inextrix/ASTPP/security/advisories