Applies to every repository that does not define its own.

Use GitHub's private vulnerability reporting, from the Security tab of the affected repository. If unavailable there, email info@blacklanternsecurity.com.

Never a public issue, pull request, discussion, or Discord message.

Include the repository and version or commit, the conditions required, the impact, and the exact commands or input. Quote output verbatim.

• Initial response within 72 hours.
• We confirm receipt, say whether we reproduced it, and keep you updated.
• Disclosure is coordinated with you before public release. Reporters are credited on request.

Fixes land on the latest release. Older releases are not patched.

In scope: code in repositories owned by this organization, and artifacts published from them.

Out of scope: third-party services we link to, findings requiring an already-compromised host, scanner output with no demonstrated impact.