Unless a repository states otherwise, only its default branch is considered supported for security fixes.

Do not open a public issue for security problems.

Use GitHub's private vulnerability reporting flow from the repository Security tab when it is available. If that option is not visible, contact the maintainer privately through the contact methods listed on Dan Knauss's profile or dan.knauss.ca.

Include:

• Affected repository, file, workflow, or feature
• Clear reproduction steps or a proof of concept
• Impact assessment
• Suggested mitigation if you have one

• Initial triage response: within 5 business days
• Status update after validation: within 10 business days
• Public disclosure: only after a fix or mitigation is available