Please do not report security vulnerabilities through public issues, pull requests or discussions.

Report them privately instead:

• Preferred: on the affected repository, open the Security and quality tab and click Report a vulnerability.
• Or by email: write to oss@bonfire.today with SECURITY in the subject line.

Please include:

• the affected project and version
• what the vulnerability is and what an attacker could do with it
• steps or code to reproduce it
• a suggested fix, if you have one

• We acknowledge your report within 7 days.
• We confirm the problem, release a fix, then publish a GitHub security advisory.
• We credit you in the advisory unless you ask us not to.

Please keep the details private until the fixed release is out.

Only the latest release of each project receives security fixes. If you are on an older version, upgrade first and check whether the problem is still there.