Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report them privately through GitHub:

1. Open the Security tab of the affected repository.
2. Click Report a vulnerability.
3. Fill in the form and submit.

Only Strongthium Labs maintainers can see your report.

Please include as much of the following as you can:

• The affected repository or product, and the version or commit
• A description of the issue and its impact
• Steps to reproduce, or a proof of concept
• Any suggested fix or mitigation

• Acknowledgement within 3 business days
• Initial assessment within 10 business days
• Regular updates while we work on a fix
• Credit in the published advisory, if you want it

We will coordinate disclosure timing with you and publish a GitHub Security Advisory once a fix is available.

Security fixes are made to the latest release of each product. Older releases are not patched unless a repository's own security policy says otherwise.

In scope: code in repositories owned by the strongthium organization.

Out of scope:

• Vulnerabilities in third-party dependencies (please report those to the upstream project)
• Social engineering, phishing, or physical attacks
• Denial-of-service testing against production systems

We will not take legal action against researchers who, in good faith:

• Follow this policy and report privately
• Avoid privacy violations, data destruction, and service disruption
• Only access the data needed to demonstrate the issue
• Give us reasonable time to fix the issue before public disclosure