Security fixes are applied to the latest maintained release line published from this repository.
- Do not open public GitHub issues for security reports.
- Send a private report with reproduction steps, impact, and affected version details to me@ilindberg.ru.
- Use a clear subject such as
TestoCMS security report. - No public PGP key is published at this time, so email is the official private disclosure channel.
Please include:
- affected version or commit
- deployment context
- exact reproduction steps
- expected impact
- logs, screenshots, or proof-of-concept when safe to share
- acknowledgment target: 5 business days
- triage target: 10 business days
- coordinated disclosure after a fix is available