SecuringTheRealm is a small, part-time/open-source-adjacent project org - there's no dedicated security team, but reports are taken seriously and get a real response, not a form letter.

Please do not open a public issue for a security problem.

Use the Report a vulnerability button under the Security tab of this repository (private vulnerability reporting is enabled org-wide). This keeps the report private until a fix ships.

• A read on whether it's reproducible and roughly when a fix might land, once triaged - timelines vary since this is maintained outside a day job.
• Credit in the fix notes / advisory, unless you'd rather stay anonymous.
• No bug bounty - this is a personal/small org, not a funded security programme.

This repo tracks main / the latest release only; there's no long-term-support branch policy.