This default policy applies to every public repository of this account that has no SECURITY.md of its own.

Report privately through GitHub private vulnerability reporting: open the affected repository's Security tab and choose Report a vulnerability. You can also write to contact@fmind.dev, the contact address published on fmind.dev.

Include the affected version or commit, the impact, and a minimal reproduction with sensitive data removed. Do not open a public issue for an undisclosed vulnerability, and never include secrets or tokens in a report.

Only the latest release, or the default branch of a project without releases, receives security fixes. Archived repositories receive none.

These projects are maintained on a best-effort basis; there is no response-time commitment.