Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Private reports: Email the maintainers at security@emergencystorage.dev with a clear description of the issue, steps to reproduce, and any potential impact. We prefer coordinated disclosure and will acknowledge receipt within 3 business days.
GitHub Security Advisories: If preferred, open a private security advisory via GitHub so we can coordinate a fix and release.
Do not open public issues for vulnerabilities until we have confirmed and patched the problem.

Supported Versions

The main branch and the latest released tag receive security fixes.
Older tags may receive fixes on a best-effort basis.

Expectations

We will investigate, prioritize, and patch confirmed issues as quickly as possible.
We will credit reporters in release notes if they wish.
Please avoid tests that could disrupt shared infrastructure when reproducing issues.

There aren’t any published security advisories