Use HTML Skeleton's GitHub security page for private vulnerability reporting when available. Include the affected component, impact, reproduction conditions, and any known mitigation. If private reporting is unavailable, open a brief public issue requesting private contact without including exploit details or credentials.

Ordinary bugs and documentation corrections belong in regular issues.

Projects created from HTML Skeleton own their security policies. Adapt the reporting route and supported versions to the consuming project. Copying this file does not enable private reporting or establish a response-time commitment.

The supplied checks include recognizable private-key detection. They do not establish that a repository or its Git history contains no secrets.