This policy applies to every repository in the emolysis organization that does not
have its own SECURITY.md.
Report vulnerabilities privately through GitHub private vulnerability reporting. Do not open a public issue, pull request or discussion.
- Open the repository the problem is in.
- Go to the Security tab and choose Report a vulnerability.
- Describe the problem, the affected version or commit, and the steps to reproduce. Leave out real credentials and data you are not allowed to share.
If the problem is in Emolysis software that has no public repository, report it on emolysis/.github the same way.
We acknowledge reports in the advisory thread, keep you updated there while we work on a fix, and credit you in the published advisory unless you ask us not to.
Emolysis has not been released yet. Until the first release, only the latest commit on
the main branch of each repository is supported.