For repositories with private vulnerability reporting enabled, use the Security tab and choose Report a vulnerability. Otherwise email security@attractor.fi.

Include the affected version, impact, reproduction steps, and any suggested mitigation. Do not include secrets or personal data.

We aim to acknowledge reports within five working days. We will coordinate validation, remediation, and disclosure with the reporter. Please do not open a public issue or disclose an unresolved vulnerability.

Only the latest released version of each repository is supported with security fixes.