SECURITY

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability affecting the Repository, Software Utilities, website, or other Project infrastructure, please report it privately rather than publicly opening an Issue.

Please include:

• a description of the vulnerability;
• the affected component;
• steps to reproduce the issue, if applicable; and
• any other information that may help us understand or reproduce it.

Please do not publicly disclose the vulnerability until it has been reviewed and, where appropriate, addressed.

Scope

This policy concerns technical security vulnerabilities affecting the Project's infrastructure or Software Utilities.

It does not cover:

• Content or lore issues;
• copyright or licensing disputes;
• ordinary bugs or feature requests; or
• factual or consistency issues within the Constructed World.

Those should be reported through the appropriate channels described in CONTRIBUTING.md.

Response

The Lead Maintainer or a Manager will review reported vulnerabilities and may request additional information.

There is no guaranteed response or resolution time.

If a vulnerability is confirmed, the Project may take appropriate measures to mitigate or resolve it and may publicly disclose relevant information after the issue has been addressed.