Use this repository's GitHub Report a vulnerability / private security-advisory workflow when it is available. If it is not available, open a public issue containing only a request for a private reporting channel—do not include the vulnerability, exploit, credentials, customer data, or identifying target details. Do not use a funding payment or a public discussion for disclosure.

Include the affected version or commit, impact, prerequisites, minimal reproduction, and any known mitigation. Encrypt sensitive evidence using a key agreed through the private channel. Please coordinate public disclosure so operators have a reasonable opportunity to update.

Security triage is best-effort and has no SLA or guaranteed response/fix deadline. The project has not announced a bug bounty, safe-harbor program, warranty, or indemnity. A report does not create a contract or entitlement to payment. The current main branch and most recent release may be considered for fixes; older versions are not guaranteed to receive backports.

Paid security-hardening is a separate professional service described in COMMERCIAL_SERVICES.md. Purchasing it is never required to report a vulnerability, and voluntary funding does not change triage priority.

优先使用本仓库 GitHub 页面上的 Report a vulnerability 私密 Security Advisory 流程。若该 功能未启用，请只创建一个请求私密联系方式的公开 Issue，不要附带漏洞、利用代码、Credential、 客户数据或目标身份信息。不得通过资助付款或公开讨论披露漏洞。

报告应包含受影响版本或提交、影响、前置条件、最小复现和已知缓解方式。敏感证据应使用私密渠道 约定的密钥加密。请协调公开披露时间，为部署方预留合理升级机会。

安全分诊为尽力而为，不提供 SLA，也不保证响应或修复期限。项目目前没有公布漏洞赏金、Safe Harbor、保证或赔偿政策；提交报告不会形成合同或付款权利。项目可酌情修复当前主分支和最新发布版， 但不保证为旧版本回移补丁。

付费安全加固是 COMMERCIAL_SERVICES.zh-CN.md 所述的独立 专业服务。报告漏洞不要求购买服务，自愿资助也不会改变分诊优先级。