Do not open a public issue. Use Private Vulnerability Reporting.
Reports are accepted in English or Russian. Initial response within 7 days. Fix targets: Critical — 7 days, High — 30 days.
- Acknowledge the report within 7 days.
- Confirm and assess severity (CVSS) privately in a draft security advisory.
- Fix in a private fork of the advisory; release a patch tag.
- Publish the advisory and a CHANGELOG entry, crediting the reporter unless they ask for anonymity.
- Request a CVE through GitHub when applicable.
Fix targets apply from confirmation. What the workflows do and do not guarantee is described in docs/security.md.
- reusable workflows and composite actions;
- scripts they run;
- this repository's own CI.