This policy covers every repository owned by @lokkju that doesn't have a SECURITY.md of its own.

Report a vulnerability privately, not in a public issue, pull request or discussion.

Use GitHub's private vulnerability reporting: open the repository's Security tab and click Report a vulnerability. The report is visible only to the maintainers, and the fix and the advisory are worked out in that private thread before anything is published.

If the repository has no Report a vulnerability button, private reporting isn't turned on there yet. Open an issue that asks for a private way to report, leave out every detail of the problem, and you'll get a reply in that issue.

A useful report says which repository and which version or commit is affected, how to reproduce the problem, and what an attacker can do with it.

Fixes go into the latest release, or into the default branch for a project that doesn't publish releases. Older versions get a fix only when the repository's own SECURITY.md says so.