This is the default security policy for Kovir Labs repositories. If a repository has its own SECURITY.md, that one takes precedence.

Please report security issues privately. Do not open a public issue.

• Preferred: use GitHub's private vulnerability reporting. Go to the repository's Security tab and click Report a vulnerability.
• If that button isn't available: email info@kovir.org with "Security" in the subject line.

Please include:

• which project and version (or commit) is affected,
• what the issue is and what an attacker could do with it,
• steps or a proof of concept to reproduce it.

• Acknowledgement within about 7 days.
• An assessment after that: accepted, needs more information, or declined, with our reasoning.
• For accepted reports, a fix in the next release and credit in the release notes or advisory if you would like it.

Kovir Labs is a small team, so these timelines are best-effort. Thank you for reporting responsibly.

Unless a project says otherwise, security fixes go into the latest release and the main branch only.