This policy applies to every repository in the devenvy organization that does not have its own.
Report vulnerabilities privately through GitHub: on the affected repository, open the Security tab and choose Report a vulnerability (how private vulnerability reporting works). Please do not open a public issue or pull request for a vulnerability.
Include what is affected (package or app and version), how to reproduce it, and the impact you expect.
Reports are confirmed, fixed in a new release, and then disclosed in a GitHub security advisory that credits the reporter unless they prefer otherwise. Please keep the vulnerability private until the advisory is published.
Security fixes are released for the latest major version of each package and for the deployed version of each app.