Please do not open a public issue.

Use the Report a vulnerability button on this repository's Security tab, which opens a private thread, or email security@crmleaf.app with "SECURITY" in the subject.

Include the version affected, the impact, and steps to reproduce.

• Acknowledgement within 3 business days.
• Severity assessment within 10 business days.
• Coordinated disclosure, 90 days by default - sooner if a fix ships sooner.

Reporters are credited in the advisory unless they ask not to be.

An incorrect statutory calculation is a bug, and a serious one, but it is not a security issue - please report it as a normal issue so it can be discussed in the open. The Incorrect calculation template asks for the citation that turns it into a test case.

In scope: this package, crmleaf/ctc-calculator.

Out of scope: the hosted tools at https://www.indpayroll.com/free-tools, and third-party dependencies - report those upstream, and tell us so we can pin or patch.