Security vulnerabilities should be reported privately so they can be reviewed and addressed before public disclosure.

Only the latest version of this repository is actively maintained.

Before reporting a vulnerability, please confirm that it affects the current version of the project.

Do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Use GitHub's private vulnerability reporting feature:

Security → Report a vulnerability

This creates a private security advisory visible only to the repository maintainers and participants explicitly added to the advisory.

Please include where possible:

• A clear description of the vulnerability
• The affected files, components or workflows
• Steps to reproduce the issue
• The potential security impact
• Any suggested mitigation or remediation
• Relevant logs or supporting information that do not contain unnecessary sensitive data

Avoid including credentials, secrets, personal data or other unrelated sensitive information.

Reports will be reviewed as soon as reasonably practical.

The aim is to:

• Acknowledge reports within 48 hours
• Complete an initial assessment within 5 working days
• Communicate remediation or mitigation plans within 10 working days where appropriate

Response and remediation times may vary depending on the severity and complexity of the issue.

Critical vulnerabilities will be prioritised.

This policy covers security issues relating to:

• Source code maintained in this repository
• GitHub Actions workflows and repository automation
• Repository configuration maintained as code
• Documentation where it could result in a security vulnerability

Vulnerabilities that exist solely within a third-party dependency should normally be reported to the upstream maintainer.

If a third-party vulnerability creates a specific exploitable risk within this project, it may also be reported privately through this repository.

Please allow reasonable time for a reported vulnerability to be investigated and addressed before publishing technical details publicly.