Please report security problems privately, not in public issues:

• Use GitHub's Report a vulnerability button on the Security tab of this repository, or
• email hi@sugi.moe with "security" in the subject.

Include what you found, how to reproduce it and what an attacker could do with it. We will acknowledge your report within a few days, keep you updated, and credit you in the fix unless you prefer otherwise. Please give us a reasonable time to fix the problem before you disclose it, and do not access other people's uploads or degrade the service while testing; use your own deployment (see the README) wherever you can.

This policy covers the code in this repository and the sugi.moe deployment. Other deployments are run by their own operators; report problems specific to them to those operators.

To report an illegal or abusive file on sugi.moe, write to abuse@sugi.moe with the link. For a file on another sugi deployment, contact that site's operator (see its terms page).