Effective date: 2026-07-17

Report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue with exploit details, credentials, tokens, or private deployment information.

Include the affected revision or version, impact, reproduction steps, and any known mitigation. Maintainers will acknowledge the report, establish severity and ownership, and keep the reporter informed through the private advisory.

Security reports are triaged within two business days. Confirmed security defects are resolved within seven calendar days of receipt. If a safe correction cannot be published within that window because coordinated disclosure or an upstream dependency controls release timing, maintainers will record the blocker, an interim mitigation, an owner, and the next update time in the private advisory; that exception does not count as meeting the resolution commitment.

Public disclosure occurs only after a fix or mitigation is available and coordinated disclosure is complete.

This policy starts on its effective date. Its presence is not evidence of historical compliance, and no report received before 2026-07-17 is included in Tier maintenance claims. Security evidence must be redacted before it is placed in a public ledger; the private advisory remains the source of truth.