Report privately using one of these methods:

1. GitHub private vulnerability reporting: go to the repository's Security tab and click Report a vulnerability
2. Messaging application: aoqia on Discord and Slack
3. Email: aoqia@aoqia.dev

Please include as much of the following as you can:

• A description of the vulnerability and its potential impact
• Steps to reproduce/POC
• Affected versions
• Any suggested fix or mitigation

If you created, generated, edited, translated, or otherwise used AI to create your security report in any way, you must disclose the methods you used the AI for in detail as well as the parts that were human-reviewed. If your security report wasn't reviewed by a human, it will be closed.

This policy covers the code in repositories owned and maintained by the LeafPZ organisation. Vulnerabilities in third-party dependencies should be reported to the respective maintainers, though feel free to let us know too.