Do not open a public issue. Use one of:

• GitHub Security Advisory

That is the only channel, and it is deliberate. An security@ address was published here before the domain had a mail exchanger, so a report sent to it reached nobody while the sender believed it had arrived — and the embargo clock started running on its own. A channel that swallows the message is worse than no channel at all.

The advisory form is private, it notifies the maintainers, and it is where the fix and the disclosure happen.

A public issue about a vulnerability will be closed and moved to a private advisory — with thanks, not with a scolding.

If the flaw is being exploited, the embargo ends: fix and notice go out immediately.

The current major and the previous one, for 12 months after the new major is released. Security fixes land in both. While the project is on v0.x, only the latest minor is supported.

Ours: any way to bypass security.Grant, any leak of data between tenants, any failure in CSRF, sessions, password hashing, rate limiting or security headers — and any code generated by aru that is born insecure.

That last one is the most important. If the generator emits a module with a hole, the hole is ours in every project that ran the generator, and the fix has to ship with a regeneration command rather than a note.

Not ours: an application that disabled aru doctor, used SystemGrant outside its scope, or wrote SQL by hand outside a repository. Those are documentation items, not advisories.

Through GitHub Security Advisory, which issues a CVE. The advisory is published together with the fixed version — never before it.

Every advisory states: affected versions, fixed versions, impact, temporary mitigation, and credit to the reporter.

• The core depends on the standard library and golang.org/x/crypto. That is the main defense, and it is checked in CI
• govulncheck runs in CI and blocks the merge
• Dependency updates are reviewed by a person; never merged automatically
• No replace pointing outside the module in a release

A fix has two parts: the patch, and a new rule in aru doctor that stops the pattern from coming back. That is what turns an incident into something permanent — and it is the same logic as the hints on the error page.