This is the default policy for every repository under breakzplatform that does not ship its own SECURITY.md.

Email dev@joseli.to, or open a private security advisory on the repository (Security → Report a vulnerability) where that is enabled. Please do not open a public issue, pull request or discussion for a vulnerability.

A useful report says which repository and version or commit, what an attacker can do, and how to reproduce it.

Supported: the default branch of repositories that are not archived, and the services they deploy.

Archived repositories are kept for reference and no longer maintained. Reports about them are still welcome when something in them is live, such as a credential or a running service.

Please do not test against other people's accounts or data, run denial of service or automated scans against the live services, or use social engineering.