Please do not report security problems in public issues, pull requests or discussions.

Report them privately through GitHub: Report a vulnerability (repository Security tab → Report a vulnerability). Only the maintainers can see the report.

Include what you can of:

• the affected version, platform, and whether remote development (openidea-server) or plugins are involved;
• steps to reproduce, or a proof of concept;
• the impact you expect, and any fix you suggest.

We will acknowledge the report, keep you updated in the advisory, and agree on a disclosure date with you. Fixes are released as a new version, and the advisory is published once users can update.

Security fixes go into the latest release. Please check that the problem still occurs there before reporting.