Scope: How to report a vulnerability in any of Noldova's repositories, and how its details stay private until disclosure.

Report a vulnerability through GitHub's private vulnerability reporting: open the affected repository's Security tab and choose Report a vulnerability.

Never put vulnerability details, private data or a proof of concept in a public issue or comment. If private reporting is unavailable, open an issue that asks only for a private channel, and wait for it before you send any details.

• The affected repository, version and platform.
• What an attacker could do, and what access or setup it needs.
• The smallest steps that show the problem, with made-up data.

Test only systems and data that you own or may test.

The details and the fix stay in the private report while the team and the reporter assess and fix the problem. The team and the reporter agree on when to disclose it and on credit, and the advisory records the affected versions and the fix. This policy promises no response time and no fix date.

Bugs that aren't security problems, feature requests and questions follow CONTRIBUTING.md.