This policy applies to every danfry1 repository that does not have its own SECURITY.md.

Please report security issues privately, not in a public issue, discussion or pull request:

1. Open the affected repository's Security tab.
2. Choose Report a vulnerability. This uses GitHub's private vulnerability reporting, so only the maintainer sees the report.

If private vulnerability reporting is not available to you, email security@danfry.dev instead.

Include the repository, the version or commit, steps to reproduce, and the impact you expect.

• An acknowledgement within 7 days.
• Updates while the report is investigated, and credit in the advisory if you want it.
• A fix in a new release of the affected project, followed by a published security advisory.

Unless a repository says otherwise, only its latest release receives security fixes. Experiments and archived repositories receive none.