This policy applies to every tinkerologie repository unless the repository
has its own SECURITY.md with project-specific details.
Security fixes are made in the latest release of each project. Please update to the latest release before reporting an issue.
Do not open a public issue for security problems. Report them privately:
- Open the repository's Security tab.
- Choose Report a vulnerability to open a private security advisory.
- Describe the problem, the affected version, and how to reproduce it.
You can expect an acknowledgement within a few days. Once a fix is released, the advisory is published with credit to you, unless you prefer to stay anonymous.
Tinkerologie projects connect to devices and servers on your local network. They are designed for trusted networks and should not be exposed directly to the internet. Reports about deployments that do so are still welcome when the project could reasonably have prevented the problem.